trovas.ch Open in urlscan Pro
3.126.196.163 Public Scan

ec2-3-126-196-163.eu-central-1.compute.amazonaws.com

Software

sffe /

Resource Hash

0e1977c2cdde99c5386d7d906b9315e7f0eb7aea1afe9893c89a2db54f688263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "882 / 546 of 1000 / last-modified: 1621935517"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21323
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:34 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 266 KB
77 KB 34ms
34ms Script
application/javascript 2606:4700:3035::6815:4c02
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:4c02 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f86e0bacba9e7bee733aaa5ad1d4e17bb3e34fd906e5d41d94e34411f73a14a8

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 257097
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=AjHqQClNTt6kkJLqEi11mS1hewpNTFJQKCpDkPG%2FJmbTOKYeQvLab6BRhonucCDrpTXJ4XnW0ejSiYUMIMdSMhIE6QfayNAsmcKc8WkG6Z0qcit5AOdA2eww3X4zIrWrwfY4Fm1m"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 654e3fd78b59dfd3-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a44c63aba0000dfd39f267000000001

GET
H2 200 /
trovas.ch/ 2 KB
751 B 58ms
58ms Stylesheet
text/css 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://trovas.ch/?ff=1&pI=style.css&wps=true

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx/1.16.0 / PHP/7.4.18

Resource Hash

6f0cee03cafba12a1684d4f70f2c7c1d9c3534e28c3b200e618657234b23a793

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

:path: /?ff=1&pI=style.css&wps=true
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
x-sol: pub_site
display: staticcontent_sol, staticcontent_sol
x-powered-by: PHP/7.4.18
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
content-length: 593
pragma: no-cache
response: 200
server: nginx/1.16.0
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: text/css;charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 style.css
trovas.ch/ 15 KB
4 KB 50ms
50ms Stylesheet
text/css 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://trovas.ch/style.css?ff=1&wps=true

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-126-196-163.eu-central-1.compute.amazonaws.com

Software

nginx/1.16.0 /

Resource Hash

ffcc632ac20394b6d29315f30b7f8672b1fbdf38f70e129857d1bef673d45e2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

:path: /style.css?ff=1&wps=true
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
vary: Accept-Encoding Accept-Encoding,Origin
x-sol: orig
display: staticcontent_sol, orig_site_sol
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
content-length: 3800
response: 200
last-modified: Thu, 20 May 2021 16:48:11 GMT
server: nginx/1.16.0
etag: "3af8-5b452638c2480-gzip-gzip"
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: text/css
cache-control: max-age=604800
expires: Tue, 01 Jun 2021 10:58:34 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 15ms
14ms Script
application/javascript 2a00:1450:4001:82a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-4377331-90

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4ca51f91e4dae27af724e56340ba60c7018cf2eb43f4ea32119dfb87ec27f09c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35791
x-xss-protection: 0
last-modified: Tue, 25 May 2021 09:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 25 May 2021 10:58:34 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 32 KB
33 KB 73ms
29ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/764/933/038/GJJ601ekakKOISkZIrqQrg_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

f427979f860060318e4f2c9e91ec4970656b1d688724d5ff50f9b640f9575b07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 62 KB
62 KB 84ms
38ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/691/933/038/ud1jpNxgyUKTqZY2Rz321A_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

813d0d92b3365840f1effdc27e045432d3b5a1587d574c22f9fb625c8e831dcf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 27 KB
28 KB 85ms
38ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/772/933/038/NEZbngaqDUSa1Q2qCn_nSg_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

24a11563e3e888f1718bd62aed47d5e7337bb6dbdb202f2835bcc4e02ea1843e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 50 KB
51 KB 74ms
27ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/782/933/038/ad7S4honjEadYb57BzsuiQ_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

c2d663746c4ab02c13e99a5148693d5762ca4a595874d64879429e3936b1010d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 52 KB
53 KB 75ms
29ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/728/933/038/07_OFrFrP0CMv7xZQPZftg_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

4493000094ccc440b45bdc89a6b6be81603e5d5252732a8485f294e1b25ec46d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H2 200 banger.js Show response
trovas.ch/porpoiseant/ 43 KB
10 KB 17ms
13ms Script
application/javascript 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/banger.js?cb=194-4&bv=19&v=51&PageSpeed=off
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 6479a7112fd3ba54336deaf72ae4beb06258c65426d5e29d02ae524bbf18d600

Request headers

:path: /porpoiseant/banger.js?cb=194-4&bv=19&v=51&PageSpeed=off
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H/1.1 200
OK /
can01.anibis.ch/ 37 KB
37 KB 74ms
28ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/672/933/038/2vaHfk81vEO-oGarqc9snA_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

3c160f50d489dbb1d02146c4aac4941e774f4a434f36f6a3ccdc179f5795f7cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 50 KB
50 KB 26ms
25ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/758/933/038/7apQhd2XuE620PT248ctkg_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

4dfe3d7e73906e569da168121c3d8470589472e7d8ee5cba51e1ce8326391c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 36 KB
36 KB 23ms
23ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/584/933/038/6jup_QbPMESyQdpZR7SQEw_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

2d47c4b53b6473284fb7ae3a04c89db42468f11b195c4b9e2ecb65db81e346b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 74 KB
74 KB 23ms
23ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/570/933/038/Ke4a0xezpEWnFBORDrsabg_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

75666be0bc24ffc3011fb547747c05a847f07557d1a0d1af7d72c4aa88726058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 77 KB
77 KB 23ms
23ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/759/933/038/5X09Nhv6nUiPH_8Zm57ilg_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

b535e1cb9f2bd753f1384560204390f05662976a6f21d8c354b3ae4105fa4b30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 48 KB
48 KB 25ms
24ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/518/933/038/s7XZZ7gw_ES9Q-4FbZbzFw_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

96cd2e5b5409213c5fbf40d2bf9a6e7be5fc881868c3a4acb45464a0c9fc41d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 84 KB
84 KB 24ms
24ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/615/933/038/CD_n4rjMkU-l5YS9kB5VvA_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

38ee6065b8b47b2cb132e2ff780dd68a630ed5ce689fcfb628c8e6d7041bd8fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 68 KB
68 KB 23ms
23ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/484/933/038/O9ch_qf35EWn5N1WKOoLmg_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

ec2ecf78fef79f3e1c0dfba6a7017ba2c8014a0c8316338562f6a2785c45695e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 76 KB
76 KB 26ms
24ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/693/933/038/hWJmSw2K8EGFzUliU4qZoA_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

272ed34ec74dcca16d8097d1cd9b90e4bca8f237622cc06b730e48439518325f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 44 KB
45 KB 24ms
23ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/535/933/038/ZtW9uQ4NNUak2VhYEl2MOw_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

8d2fa8f953fb2b098ec9b3690a816f060e73356299f1c1cdc541ea8c52d583ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 17 KB
17 KB 25ms
25ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/461/933/038/cTXohiJH00ab2J7nJHwtcQ_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

a2ffc258c8a6eb23f0f7d30d48993ffb472cd1feda79673be2144f254ad67a22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 45 KB
45 KB 24ms
23ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/702/933/038/zi7px9nL3k-6yNcH4yHn2A_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

ad76aee610e71d508131dbb5fbf3873e74da37bb4cbebaaddb99f0d786df4bbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 56 KB
57 KB 24ms
24ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/422/933/038/O_tzeQk1v0u64swP-1atyw_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

02a3b9fe0e65c7c5cef36375ecc39d05ee5a1e30427b954813aef217bcdafbc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 64 KB
65 KB 31ms
28ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/509/933/038/w6aE4u4dNUebpD5NydbdrA_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

5c5f3ba07263d437c02a3af8325af8b0d6baf9695915d974506e6611ebbb0443

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
X-Cache: HIT
Content-Type: image/jpeg
Cache-Control: max-age=604800
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H/1.1 200
OK /
can01.anibis.ch/ 45 KB
46 KB 25ms
24ms Image
image/jpeg 91.208.180.149
SUNRISE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://can01.anibis.ch/?1024x768/3/60/anibis/755/933/038/dsYZrR8JYkmog7ZJR1lyeQ_1.jpg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.208.180.149 , Switzerland, ASN6730 (SUNRISE, CH),

Reverse DNS

Software

nginx /

Resource Hash

30bf35080c064c7fb96e5a6c3206828001546b4a716a78aa3eca35621d86c3aa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubdomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:35 GMT
X-Content-Type-Options: nosniff
Server: nginx
X-Frame-Options: DENY
Content-Type: image/jpeg
Cache-Control: max-age=604800, public, no-transform
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
Expires: Tue, 01 Jun 2021 10:58:35 GMT

GET
H3-29 200 pubads_impl_2021051801.js Show response
securepubads.g.doubleclick.net/gpt/ 308 KB
108 KB 24ms
22ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77e7ad71599b73f06bcaea11c25e128d50c80f6e7fb0cc10f317779fc285d954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 18 May 2021 08:37:05 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110938
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:34 GMT

GET
H2 200 ezosuigeneris.js Show response
g.ezoic.net/ 555 B
563 B 34ms
12ms Script
text/javascript 18.156.95.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigeneris.js
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.156.95.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-95-187.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: b0ae42e5c4a559e876b61b6f4818927ab2dd95a484bba6ee493bea4f96788ee2

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
last-modified: Thu, 20 May 2021 16:48:11 GMT
server: nginx/1.16.0
etag: dea97f83404861dc804f8a0386a68858
vary: Accept-Encoding, Accept-Encoding
content-type: text/javascript
cache-control: max-age=999999, private
content-length: 276
expires: Mon, 29 Apr 2020 21:44:55 GMT

GET
H2 200 cmb.js Show response
trovas.ch/detroitchicago/ 122 KB
31 KB 23ms
21ms Script
application/javascript 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: fac8fa18277e097ed22416876c72c7973dc6a001c4ad6014ed2a9db056d9c79e

Request headers

:path: /detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
DATA 200
OK truncated
/ 70 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1b112735cd560ccdafebb2cb9f6a66efb65e00721265a1ffab0ca3341105983d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5dabda3c6f0eb9c30d61aeaac42d50d81e247093f88bf51db72d7e97c6dea1b8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 71 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 774ccf1a7033950e23c7f32b21b95d0b25d60427d63ff4abb0050b089a1b5612

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 i3.png
trovas.ch/img/ 3 KB
4 KB 22ms
22ms Image
image/webp 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trovas.ch/img/i3.png?ezimgfmt=ng%3Awebp%2Fngcb4
Requested by: Host: trovas.ch
URL: https://trovas.ch/style.css?ff=1&wps=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 2c3b7b288c8d0fa45fe3520a694e0b788a17036cdd4e27327fd3d6fc7d9d6ce3

Request headers

:path: /img/i3.png?ezimgfmt=ng%3Awebp%2Fngcb4
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: trovas.ch
referer: https://trovas.ch/style.css?ff=1&wps=true
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/style.css?ff=1&wps=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
age: 79681
x-amzn-requestid: e144958b-c0a0-4528-ac5b-dd45adc73768
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: f1Yb7HtHIAMFldw=
content-length: 3454
display: staticcontent_sol, staticcontent_sol
response: 200
server: nginx/1.16.0
x-amzn-trace-id: Root=1-60aba119-09a08d900190fbf73de7eac6;Sampled=0
vary: Accept-Encoding Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 9bca546700a965c9c77ef5b8dbe65cc4.cloudfront.net (CloudFront)
cache-control: public, max-age=2592000
access-control-allow-credentials: true
x-amz-cf-pop: FRA6-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: JoO5TvCSPWTK-07V-IaRlzl13urdrX68Rs4OnR04Bmbb0Hdvci-sfQ==

GET
H2 200 imp.gif Show response
trovas.ch/detroitchicago/ 43 B
164 B 12ms
11ms XHR
image/gif 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A0%2C%22ad_lazyload_version%22%3A2%2C%22ad_load_version%22%3A2%2C%22ad_location_ids%22%3A%221%2C1%2C1%2C5%2C3%2C21%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A6%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A3%2C%22city%22%3A%22Frankfurt%20am%20Main%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A3%2C%22domain_id%22%3A174954%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%22483%22%2C%22iab_category_1%22%3A%22539%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A1%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1116%2C1118%2C1126%2C1126%2C1126%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%220ffb8df5-2e14-4d19-5535-2c00d1ae46bd%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%2260326%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A36625%2C%22response_time_orig%22%3A38%2C%22serverid%22%3A%223.65.20.135%3A18241%22%2C%22state%22%3A%22HE%22%2C%22sub_page_ad_positions%22%3A%221100%2C1116%2C1118%2C1126%2C1126%2C1126%22%2C%22t_epoch%22%3A1621940314%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Ftrovas.ch%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A1265%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

:path: /detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A0%2C%22ad_lazyload_version%22%3A2%2C%22ad_load_version%22%3A2%2C%22ad_location_ids%22%3A%221%2C1%2C1%2C5%2C3%2C21%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A6%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A3%2C%22city%22%3A%22Frankfurt%20am%20Main%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A3%2C%22domain_id%22%3A174954%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%22483%22%2C%22iab_category_1%22%3A%22539%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A1%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1116%2C1118%2C1126%2C1126%2C1126%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%220ffb8df5-2e14-4d19-5535-2c00d1ae46bd%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%2260326%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A36625%2C%22response_time_orig%22%3A38%2C%22serverid%22%3A%223.65.20.135%3A18241%22%2C%22state%22%3A%22HE%22%2C%22sub_page_ad_positions%22%3A%221100%2C1116%2C1118%2C1126%2C1126%2C1126%22%2C%22t_epoch%22%3A1621940314%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Ftrovas.ch%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A1265%2C%22worst_bad_word_level%22%3A0%7D
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true; ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding Accept-Encoding
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
content-length: 47

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
9 KB 8ms
8ms Script
application/javascript 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bba4d46952f094b62205fe06e4a78114cac5d934971925a4716ef40c33f96012

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: gzip
etag: "WhyxmPkT7L77qVDcrjxwGw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Tue, 01 Jun 2021 10:58:34 GMT

GET
DATA 200
OK truncated
/ 42 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c90cff659645a312a28804965f3dbc34061338f7234ff5d6ddb2c57e9eadec15

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 ezosuigenerisc.js Show response
g.ezoic.net/ 0
54 B 20ms
19ms Script
text/plain 18.156.95.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/ezosuigenerisc.js?nogen=1
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.156.95.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-95-187.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
cache-control: max-age=300, private
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding, Accept-Encoding
content-type: text/plain; charset=utf-8

GET
H2 200 houston.js Show response
trovas.ch/detroitchicago/ 3 KB
1 KB 10ms
9ms Script
application/javascript 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/detroitchicago/houston.js?gcb=4&cb=36
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 1d6f7818a09adfc9c11ff7110eb866179ef9d36a3625cd1c02e23292d315daaa

Request headers

:path: /detroitchicago/houston.js?gcb=4&cb=36
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true; ezouspvv=0; ezouspva=0
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:34 GMT
content-encoding: br
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public
x-robots-tag: noindex
content-length: 1163

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 13 KB
7 KB 846ms
846ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=3557128497893380&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-box-2&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1&prev_iu_szs=300x250%2C300x250%2C300x250&prev_scp=a%3D%257C251%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D350%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D32%2C13%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%7Ca%3D%257C3%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D350%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D32%2C13%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%7Ca%3D%257C3%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3D9e0a1ce5b2455cb9b48d5df4c6bf4053%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D350%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D2%26stl%3D37%2C14%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1621940315&dt=1621940315017&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=315%2C639%2C962&adys=171%2C171%2C171&adks=840336167%2C3122676339%2C3122676338&ucis=1%7C2%7C3&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250%7C323x250%7C323x250&msz=323x250%7C323x250%7C323x250&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=0%2C0%2C0&ohw=0%2C0%2C0&btvi=0%7C0%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

190db6f27a69b9395762db889c85216f91f363030d182a46b3116d73dcbcad87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7382
x-xss-protection: 0
google-lineitem-id: -2,-2,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/ 0
0 28ms
14ms Other
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-38/html/ 0
0 6ms
5ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 454 B
275 B 456ms
456ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=1723206319546020&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&prev_scp=a%3D%257C252%257C%26iid5%3D456778%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dtrovas_ch-medrectangle-2-456778%26eb_br%3Deeb0e32289ff31f9ddef18331038e5e9%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D900%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1621940315&dt=1621940315038&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1108&adks=2530142577&ucis=4&ifi=4&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

689a1fa864696fc233a50c1e417f33814a4cd8e7c35e896f455aa4304f6737ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 245
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 nmash.js
trovas.ch/porpoiseant/ 33 KB
9 KB 12ms
12ms Other
application/javascript 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/nmash.js?v=19
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 0b9a8a3f27fa969797b4fbec0716dcacd5aaa38202277691d7baf41a540963fd

Request headers

:path: /porpoiseant/nmash.js?v=19
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: same-origin
accept: */*
cache-control: no-cache
sec-fetch-dest: worker
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: br
last-modified: Thu, 20 May 2021 16:48:11 GMT
server: nginx/1.16.0
etag: "854d-5c2c5b56208c0;5c2c5b56208c0-gzip"
vary: Accept-Encoding Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000, public
accept-ranges: bytes
x-robots-tag: noindex

GET
H2 200 greenoaks.gif Show response
trovas.ch/detroitchicago/ 0
127 B 9ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDUtMjUifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIyIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJ1bml2ZXJzYWxfdXNlcl9pZCIsInZhbCI6ImRlYTk3ZjgzNDA0ODYxZGM4MDRmOGEwMzg2YTY4ODU4In1dfV0=
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDUtMjUifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIyIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii0xMjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfdGFnIiwidmFsIjoiZW4tVVMifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoibGFuZ3VhZ2VfcHJpbWFyeV9zdWJ0YWciLCJ2YWwiOiJlbiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJ1bml2ZXJzYWxfdXNlcl9pZCIsInZhbCI6ImRlYTk3ZjgzNDA0ODYxZGM4MDRmOGEwMzg2YTY4ODU4In1dfV0=
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:34 UTC

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
19 KB 8ms
5ms Script
text/javascript 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-4377331-90

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

2cb09c7b3e19bfc41743ca3624ef81c3258d56525647feac76aa757e0292627a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 09 Apr 2021 23:59:54 GMT
server: Golfe2
age: 5319
date: Tue, 25 May 2021 09:29:56 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19569
expires: Tue, 25 May 2021 11:29:56 GMT

GET
H2 200 tr.jpg
trovas.ch/img/ 4 KB
4 KB 24ms
23ms Image
image/webp 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trovas.ch/img/tr.jpg?ezimgfmt=ng:webp/ngcb4
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: 9c966e431778c1dcb42ef3389115f209f07d8d04bf0b221504425fc81159dafc

Request headers

:path: /img/tr.jpg?ezimgfmt=ng:webp/ngcb4
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezosuigeneris=dea97f83404861dc804f8a0386a68858
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: br
age: 77256
x-amzn-requestid: 64a10ad0-bee7-45e5-a1c7-9ab99479ff2d
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: f1eXBEYmIAMFdtg=
content-length: 3656
display: staticcontent_sol, staticcontent_sol
response: 200
server: nginx/1.16.0
x-amzn-trace-id: Root=1-60abaa93-651b9e5e2cc1badc16da3f9c;Sampled=0
vary: Accept-Encoding Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 a0a81637cc76d6981e4e29044a73b7f6.cloudfront.net (CloudFront)
cache-control: public, max-age=2592000
access-control-allow-credentials: true
x-amz-cf-pop: FRA6-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: jaaiFT5mfxkWDAp2-65VGcbDKB9Lzcv2m6lhZaoKUcnyeRdPcI5Idw==

GET
H2 200 arr.png
trovas.ch/img/ 3 KB
3 KB 31ms
30ms Image
image/webp 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://trovas.ch/img/arr.png?ezimgfmt=ng:webp/ngcb4
Requested by: Host: trovas.ch
URL: https://trovas.ch/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: f3d9b11f0214ef1686c1e744aac68cdb7f00d0fca136bc211c4fe42290d1c797

Request headers

:path: /img/arr.png?ezimgfmt=ng:webp/ngcb4
pragma: no-cache
cookie: PHPSESSID=fui8u7a9o2aq9agl9q60dbu0d5; ezoadgid_174954=-1; ezoref_174954=; ezoab_174954=mod12-c; active_template::174954=pub_site.1621940314; ezopvc_174954=1; ezepvv=582; ezovid_174954=1183175132; lp_174954=https://trovas.ch/; ezovuuidtime_174954=1621940314; ezovuuid_174954=2ea421bd-7214-4234-4e2e-9515eddd2863; ezCMPCCS=true; ezouspvv=0; ezouspva=0; ezds=ffid%3D1%2Cw%3D1600%2Ch%3D1200; ezohw=w%3D1600%2Ch%3D1200; ezosuigeneris=dea97f83404861dc804f8a0386a68858
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: br
age: 84655
x-amzn-requestid: 0fa57aeb-0331-4b6a-864b-43b881e56027
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
x-amz-apigw-id: f1MS0Gl3IAMF_8A=
content-length: 3180
display: staticcontent_sol, staticcontent_sol
response: 200
server: nginx/1.16.0
x-amzn-trace-id: Root=1-60ab8dab-1f88964d27bfba980a10187c;Sampled=0
vary: Accept-Encoding Origin,Accept-Encoding
access-control-allow-methods: GET
content-type: image/webp
via: 1.1 21da0a66bafe2c8de8be4a4d8039346b.cloudfront.net (CloudFront)
cache-control: public, max-age=2592000
access-control-allow-credentials: true
x-amz-cf-pop: FRA6-C1
access-control-allow-headers: Content-Type, Authorization
x-amz-cf-id: tDkgcYLsCCyOZ9PE9J3mMF7d6ZI7O-d-wSRXvfwRisqoHRVLho_95Q==

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 3 B
428 B 7ms
7ms Script
application/javascript 2600:9000:211e:c00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:c00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 17:14:39 GMT
via: 1.1 a7631312afe99e40229aa0da70662113.cloudfront.net (CloudFront)
age: 63836
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:50:24 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
x-amz-cf-id: Gc-nn8Ke-3mCehE-ck-ud2L_UR-LcBl2S8wqRBqkXsTTcO37WCprJw==

POST
H3-29 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 13ms
13ms XHR
text/plain 2a00:1450:4001:82f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j90&a=1451153988&t=pageview&_s=1&dl=https%3A%2F%2Ftrovas.ch%2F&ul=en-us&de=UTF-8&dt=Dein%20Gratis%20Inserate%20und%20Kleinanzeigen%20Marktplatz%20-%20trovas&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=1722593664&gjid=2146756097&cid=1644131464.1621940315&tid=UA-4377331-90&_gid=273971704.1621940315&_r=1&gtm=2ou5j0&z=207386204

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:35 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=1437288299;labels=Domain.trovas_ch%2CDomainId.174954;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Ftrovas.ch%2F;uht=2;fpan=1;fpa=P0-2117854871-1621940315137;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7...
pixel.quantserve.com/ 35 B
371 B 11ms
11ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1437288299;labels=Domain.trovas_ch%2CDomainId.174954;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Ftrovas.ch%2F;uht=2;fpan=1;fpa=P0-2117854871-1621940315137;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=82efd7d8-20210517233434;cm=;gdpr=0;ref=;d=trovas.ch;je=0;sr=1600x1200x24;dst=1;et=1621940315136;tzo=-120;ogl=image.https%3A%2F%2Ftrovas%252Ech%2Fimg%2Ftr%252Ejpeg

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:35 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 greenoaks.gif Show response
trovas.ch/detroitchicago/ 0
19 B 10ms
10ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjI0In0seyJuYW1lIjoicGVyZl9jb25uZWN0X3RvX3Jlc3Bfc3RhcnQiLCJ2YWwiOiIyMDcifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjYifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiMjIxIn0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMjI5In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjM0MiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9wYWludCIsInZhbCI6IjMxMyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9jb250ZW50ZnVsX3BhaW50IiwidmFsIjoiMzEzIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZWZmZWN0aXZlX3R5cGUiLCJ2YWwiOiI0ZyJ9XX1d
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjI0In0seyJuYW1lIjoicGVyZl9jb25uZWN0X3RvX3Jlc3Bfc3RhcnQiLCJ2YWwiOiIyMDcifSx7Im5hbWUiOiJwZXJmX3Jlc3BfdGltZSIsInZhbCI6IjYifSx7Im5hbWUiOiJwZXJmX2ludGVyYWN0aXZlIiwidmFsIjoiMjIxIn0seyJuYW1lIjoicGVyZl9jb250ZW50bG9hZGVkIiwidmFsIjoiMjI5In0seyJuYW1lIjoicGVyZl9jb21wbGV0ZSIsInZhbCI6IjM0MiJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9wYWludCIsInZhbCI6IjMxMyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJmaXJzdF9jb250ZW50ZnVsX3BhaW50IiwidmFsIjoiMzEzIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZWZmZWN0aXZlX3R5cGUiLCJ2YWwiOiI0ZyJ9XX1d
pragma: no-cache
cookie: __gads=ID=d67441491c90e0c9-2288989d1ec80039:T=1621940315:S=ALNI_MYdu3mHSVaWzbnb5EjEUK2cMMsAmg
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:34 UTC

GET
H2 200 greenoaks.gif Show response
trovas.ch/detroitchicago/ 0
42 B 10ms
10ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjkuMSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX3J0dCIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjY4NiJ9XX1d
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9kb3dubGluayIsInZhbCI6IjkuMSJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImRhdGEiOlt7Im5hbWUiOiJjb25uZWN0aW9uX3J0dCIsInZhbCI6IjAifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjY4NiJ9XX1d
pragma: no-cache
cookie: __gads=ID=d67441491c90e0c9-2288989d1ec80039:T=1621940315:S=ALNI_MYdu3mHSVaWzbnb5EjEUK2cMMsAmg
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:35 UTC

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 10 KB
7 KB 17ms
16ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021051801&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

368bb00304169d6875a0831e0693b9eb886dffb70861d2f4b1371e53137ee567

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7576
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:35 GMT

GET
H3-29 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 15D3 12 KB
5 KB 15ms
13ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/222/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://trovas.ch/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://trovas.ch/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 5022
date: Tue, 25 May 2021 10:28:59 GMT
expires: Wed, 25 May 2022 10:28:59 GMT
last-modified: Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1776
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js Show response
pagead2.googlesyndication.com/bg/ Frame 15D3 14 KB
6 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096abd9dd93ed6879a4454b0e7e80392462e97bbeeff715de8ea45a0577470d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 19:06:10 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 09:08:00 GMT
server: sffe
age: 57145
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5728
x-xss-protection: 0
expires: Tue, 24 May 2022 19:06:10 GMT

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 41ms
40ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021051801&jk=4284956054765355&bg=!ra6lrurNAAZ7hX_Ue4U7ACkAdvg8Wtw9rJBh7qwv0l2-nGd9-ZBSfOqYzQmAHNXCydMtN7hfP2P24gIAAABZUgAAAAxoAQcKAWa9pHgt04je09J4WDmfM1YdG2NupMEsoLi9Azsrn6JxsYIlSPhYWqtbEoAcMJp0OKoYXIRyYvmqDnmNKTGlHKIFnEzOTHOJbRcgfYLd6f65cBZq84E0VL8zR9iTVPE8qPZ1L-pYavDJ9aqSMAcSg5QhYJfFcjFJcZxi2N87SDGzIrHLMm1WCTTvEs3UT2Rowh9qx1JVPsbqj_Gy46JL1zOqHN7aoBl_3qfe61ugqIE-JteaAG3vLOME9vf3c_xeDADc3pKE-4BWy7SXR0HemCalNWNYhTEAQnfP23pWQPfcGh1WA4qP0I97KMHf3G8S_edcX2nKzd4DprKEed_PT3NUoaxTEgrFl8pfM9rwcxsXhdlbzHDAEIWDAEHi10BGoVDtDTGPKomL3rQXFx-Ea_4htGRXsI3hwubOtD2chwIf8hKPMliljrIQSU28XQ3JaHXVR8lOkQeWjOPeWSxNW4yOsH61MNd0mQIxXwBk4mxZBaqkN7cL2ba3MVgfaVa0zl29T32Fqj2Rx_zJuTRL0gd1PKmYv3GMgi91L5C1MfTFN_M9qKDeIZYrr7xLwboSOMSUiyJgbjcBaUPOpAF326xjqM00dvSZiSnIXikD5rd5bIpIdxg0vhXEBhSBVxHGkRCibUM9tCqJvyhDRfCBiyPa4s7wPZlVa0xNYedcA26hksVfiGcNwDNMVGmD-GH5RhaYNMVNDorj2BvKuA5VGChnaPgNFRG7zzINywe6bSRGdf0gMk741Vydk3Bai0Q_7izpOd5mKHsBDMZ82ArzZzTVSr-0V6bWmQeAB_ggwNIyKJ-N-3zltqtVe56rOnvWqPWNKXTJDnIqDmip3l6RyxAmQ6P_V_IYqFiBc0VJ60GjnQMzDNk3lFT6Wb0DO9AXeyB-NWdP7zAaNr_NM-prA1Dcy9qQadQuAX1v3hvDyAmEE6-u2S5ApKpHk_CcGoc6DeZX_9E_ADGIp0_Pj3LFLzVcwwGGt04W_oVR8ehiDhW-B994ywQkN7z822gAheF78PXPHQBKYvjcOFyOBsBTmU-y2TUU8G_uSqUMaUVPi5uZRdC0mBucLjqPyx6KQDj9FNJmZc4GeqB70e4A8_8HFL45BkJUtFBdBv2rbxVAoMXx2J6cPaN1jzAaemjz5xXh0e1vOB5g5AAb8mWjhB7CyWDmx30qTQzKnmlt18CrjZuOuvrdGDPoeGepc_y-Mjp0CUlhYl9D9RfnU6Hp

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame CE07 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://trovas.ch/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://trovas.ch/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 25 May 2021 10:58:35 GMT
expires: Wed, 25 May 2022 10:58:35 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
27 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d20865ab544e7dab6a0553034edc5845335cd7c23375745db9a755c532311463

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1621855618012992"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27995
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:35 GMT

GET
H2 200 greenoaks.gif Show response
trovas.ch/detroitchicago/ 0
19 B 9ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjEwODYifV19XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjEwODYifV19XQ==
pragma: no-cache
cookie: __gads=ID=23d3f965baeb32e6-2285b8c01ec8004b:T=1621940315:S=ALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA; ezouspvv=350; ezouspva=1; ezouspvh=350
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:35 UTC

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 9ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiI5ZTBhMWNlNWIyNDU1Y2I5YjQ4ZDVkZjRjNmJmNDA1MyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMzUsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDM1LCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1OTEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiI5ZTBhMWNlNWIyNDU1Y2I5YjQ4ZDVkZjRjNmJmNDA1MyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMzUsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDM1LCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1OTEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: __gads=ID=23d3f965baeb32e6-2285b8c01ec8004b:T=1621940315:S=ALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA; ezouspvv=350; ezouspva=1; ezouspvh=350
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:35 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
93 B 35ms
8ms XHR
text/plain 18.156.95.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: trovas.ch
URL: https://trovas.ch/porpoiseant/banger.js?cb=194-4&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.156.95.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-95-187.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 25 May 2021 10:58:35 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 9ms
8ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA1LTI1In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTIifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMiJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA1LTI1In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTIifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMiJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=23d3f965baeb32e6-2285b8c01ec8004b:T=1621940315:S=ALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA; ezouspvv=350; ezouspva=1; ezouspvh=350
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:35 UTC

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 9ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImF1Y3Rpb25fZXBvY2giOjE2MjE5NDAzMTYsImFkX3Bvc2l0aW9uIjoxMTI2LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiYmlkX2Zsb29yX2luaXRpYWwiOjM1MCwiYmlkX2Zsb29yX3ByZXYiOm51bGwsImJpZF9mbG9vcl9maWxsZWQiOjM1MCwiYXVjdGlvbl9jb3VudCI6MSwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6ODY4LCJtdWx0aV9hZF91bml0IjoyLCJtdWx0aV9hZF9jb3VudCI6MywibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImF1Y3Rpb25fZXBvY2giOjE2MjE5NDAzMTYsImFkX3Bvc2l0aW9uIjoxMTI2LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiYmlkX2Zsb29yX2luaXRpYWwiOjM1MCwiYmlkX2Zsb29yX3ByZXYiOm51bGwsImJpZF9mbG9vcl9maWxsZWQiOjM1MCwiYXVjdGlvbl9jb3VudCI6MSwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6ODY4LCJtdWx0aV9hZF91bml0IjoyLCJtdWx0aV9hZF9jb3VudCI6MywibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
pragma: no-cache
cookie: __gads=ID=23d3f965baeb32e6-2285b8c01ec8004b:T=1621940315:S=ALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA; ezouspvv=350; ezouspva=1; ezouspvh=350
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:35 UTC

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4BD2 478 B
535 B 21ms
19ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBENujDxj4hKSmATAB&v=APEucNXUBW8-LmPR8WYojSMpB2ZUyiZsE9cJxriGRk2xBJ8OiGiYssqQbIMJ7lDs4HxG4W2sn2B89zYN9vG1cnSkfDkORg8b5zp530Pk46gujY6gLq8f29y8tWe8Va9qC1hgei-ae89nuuw_ImO26gZlRQNZJy7zZ_Zjc4F_1CwBFx3xWaC3whhHEbCK4iuQvKHndgeqzivOi6Es5M521BgyEvvMZVVQHd01w-9KO_w_iQP6fwhv4zo

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0414d0221112224b4c926de91a6e316f9d9aba685aa8b05fd0654848d8fcdf55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNgBENujDxj4hKSmATAB&v=APEucNXUBW8-LmPR8WYojSMpB2ZUyiZsE9cJxriGRk2xBJ8OiGiYssqQbIMJ7lDs4HxG4W2sn2B89zYN9vG1cnSkfDkORg8b5zp530Pk46gujY6gLq8f29y8tWe8Va9qC1hgei-ae89nuuw_ImO26gZlRQNZJy7zZ_Zjc4F_1CwBFx3xWaC3whhHEbCK4iuQvKHndgeqzivOi6Es5M521BgyEvvMZVVQHd01w-9KO_w_iQP6fwhv4zo
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 25 May 2021 10:58:35 GMT
server: cafe
cache-control: private
content-length: 230
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlzgpEdMvH8tcbUZxKfTq9skpoubDiAenINHP_jVw01q-D_oor5bpaA4jzg; expires=Sun, 19-Jun-2022 10:58:35 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 25 May 2021 10:58:35 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame CE07 65 KB
25 KB 47ms
44ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A780PVDSPlaMVB5zHLo-WnshggTzNMtN-DqyLfkuwQr6epj9c6HStcIwk6PzppxkNYsCQbPyTRkYmiq3UfhkqKCSuGeHdo_pQXxrvu-7vDAzd4-zIDEf6eXVf_JiJ-qngw4a-0H8RSMx7eXSta9MSNurovfw&dbm_d=AKAmf-AvqiOTsez3vlFfp-i-HFHcI2y-9S6aBWP0LUHgDJT0E92Axl9-Jy1eXvu3eVTVTeFcqRJj2Yow9p8Ep2T5TU0nPX7pDIgiGXqWF4BsuVXdKwfvTvcLSremD_dku9Uw9DpyMGmfKIzIa5nf7ndSaACe_LdkxA-XDZ8seXmSWT8_e9FLnBai5db00yMjZ_pSsTmk-c2TcPn3i69Maa--gF63DUB-qad6qjGJlzy8XIqI84TuKPdf9usxMo4s6l3Z2f8k4-28C3CYKKmvdW7PDfeCqTOc3wnc1uF8uzUyYiYDrsTZMrZt9NBRwYaTJxmUKA4g8HEXKFC4fnWYk2UL6mICXo-MsPvDCmuXNIMs5oO60fOriC16QOSztiyLY-iDkNMHUguv-hSyjaCqo9MDf2LJSngUtjmNHiEwJdNfuB_aoCwIC1xv-CC4T_lD19faQs2WEaXzQTyAcgUnt3LPB7RSFyYL60BSMBSBYNqngEz6ZdgHwrcLWfsnXW8qOvHd9vw7j7mbl4xrx-h0Sh2-h8L9A_ifvndwMxS4NTjGyVswQkXipVXkCAqN6c55olRuITsX_ssPtgDEiDHGFOhF8y11ixZs8f8xJc3PDTMVkCrFXeBIohRVtSqRalurrOvt_OgSZE9FEQ-RftG2OJom5Fse1uMBwZOiDR-HHWWi9IylYwLmB55Em5t1RkhF38MKw6hvus5xslVoqsisxzuF6HNKmX4a8la9nxzFXAVpGjgFhbnEr5Fl-gP-tt7CgFKRuDhf4gUNurmVrwM-8P-o-bvbthW6KXsC2G0KX8ftAGR6V51ojQhjkx-nWrXXTsr-Sjbo1our5wH2QwxWHKX-2CD1ysaOrLnWJ5GAR_64KioEZ7tn-TUgrlWP-YKieiJyQgHoN9d6vxJ0zAawMLINJQoWkKnjeUc4lIosdw_hcf-Rv94Y22UNFyKYTweHL_fQH3zOq4CGQ8PrckcRzk8qCvPtHLaBlwS6aeMKb92KB6fcOUiLh4Dsu8c0K-9s0qIOgJpjK69YwTkvttbEwFcQWn3Q-5KbBx95D5rxW8UYgAmzo477xTKC8RsoLrH8CUsNh_iRF9BJj2rkC8gVhri1llbQ9Ip2mRJHXFB7R0YlnNKHsNqj70tsQpPaRn8t-zUl8XKsHk0blwfxaAcvs4xijuR3F0IPJNRHsdx7Gv5sDzwI6Ze8UGYuef7EpHTzU1Y3l0mDwfp2KHdAHxwNF79Gtb6Nvq1XbMCbKp_RUhrnefgpJwdjW1loG7KCBA-kJAU8_94CqkwMNHRvDgvW0Pu7hKHqdFdalaJAhYzl1j1lkH8AF9hYo34QaCDSCtuKYxagpaZvEW07GyUVYrAYYeruL_jC64BGHQWr1atlm5p_fz3Y-QEuZ49oGPZuRTrWg3onZw6ddsV-yXMLW9qx06-O38X51Pma4j3wUgGOun9Ndk0nfmXyZTRXu6kTcPEz8CuhQMzhIq53w-F9ErK7wi5nlJ--odvhyynQnyDrUgahNU0C-7sbVGIKHq_zc4NugfyCX0ZoyVXiSP66bVW3zO7WW2dqzYysBfIat603HHI8YAK8EtvyWdOe1_mJnzdd3GZFjCXXN9mULGmKA5dO5EZNLtk_phcCCQpNZo3AmNBXdk8KZiAjMoWnDf1wmWUlnYoXKNny-NpRhcuXApIc6veUsKLu1LIr3MDUZxiC1G9ubq41AxC9l6lyCZXkAnVuSSqpdF8vD0_rOfD6QJTa9HBLrcdpDaH1b_W07xWheiEMZGdo8nml7Pg113KipVKKQ15WvW3MTVd8RgXKkd7TDbKGnY8O1BPmQlhaNzvZVZRu16h7mc1p8hG_Ua-14DKiLPFyMh_dOvH3UPnLdKnTHDDcuLibnEEArY0cDNbyqWxUKG9rftDdvSYgCp7oeoMRT1oFZkZNGOoKGSSl5y2p8xRu_QPYVpi8xn1F7xgSyYKF4WNysjl4nRvkpLMv3xqUbAbcU6I5VFPaWeZKv_0BzBA8QBxgO3GxHNvCewIpyT1ZhouWFFj4HX6S4Io1B9Pq3-n--lrJE1PUUs9E_yLaoorFKyCIdPzQDzzE54rzYOwt9Lt3rV1M-KiWWG74yeXeLPmMuUa3zVEKBQf1m9evMbHCCzwGEees-iHNSMpeKf3NgODJ4zEe-0wL0Xv9r7FbBZvvnjLSPY--fBp9L3GQMYWQMeFf6srobTo7UfYIBMgknPHMj9EyRULHyQS02NBzWYKYNqyi4pmVVU_b8ymEkMeeEo19zI5zJnraouzJMji8WyvZXsAq2RzaTtTYG_tFT4B62lm5-VsNBziblBHfGRw3pj4CpxJFDE0IoqIrQgGZM3RRYugLQMCmST83_PIHWui7vp2FOZ8D_8_7P__3mEylRxuYLILq-Yp9fvRgWs7rY9wz9gs9RKUDRZ5P87c85NgzbDGJzulxEP2u7L_yY-KFQovV2q-EBLQeSHL5Ih4XMckj8KWmMCbHDDMUWGQtYExlrjmPqGEpvKfxKErp3ObFfJaOnnKJvYmQQm4efJDY8qCzCVL3ERJPP-WtKHTeXhqYvm1ucCbn4WJKCfiGFW2pLnDJ5nAsukuLNaN6vphHo5Oci_TJHYQQey3NApg4-D3lF5p5ygBQAXqWPRvCyR6Vc79frc2aUqJ4tdXwJO0qkjUCKZ0Le-yyewI8XNwiTiWNVI71yDiBVkH7oOtfEkh5f0kv_hHGZKwziId2Kuk3mDRf-Yj396fTABIOd--dsBbvFjgy-lIcIETVyVDd8yi7RPt3RTwlZS9oHAWZxdc5hI70DodDRVwuprv0QefhCztH2cfb8pOckj46zDIOIfC2Wxt0BE1lp4PSC7SmAMCs4oTLxuQNIKPhE6RukTBokuyDZnVlM4OsDbtwTFRqVhXFyMRABCbg9UxLLQtTqlAAkCPs51rDyxJQijdtl7C-S-vJSfZKpBXCorVcamNpn6g2EUSi84ozf2tv__RmcSiN1ZuwQ3Y_Z_SzpVoPC4YwWyOEstSJs3WJRfss9gmTXJJ_ncihFBb3e72bwzOMkFpicK43JDqefr4&cid=CAASFeRoij4nmvz1Q5XoRaurllJ9j_ud1g&rfl=1%2Chttps%253A%252F%252Ftrovas.ch%252F%240

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

58ba02c8ca0968001ed7573dc5ccfe8846427d6742e7df3ca27bcce19e9ad9bf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25130
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame CE07 42 B
63 B 41ms
38ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cu5hjUqHRLG-muCn2xlO8DdzsBe89N0VSmrmyjZwh_Fv9ehWwYfc3fR7HeGv9FrsYZLFBq5wwC8inaLI8sRXCkZJZqw_zl3eJFJOb0bIuh4L_i7lY

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame CE07 2 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/window_focus_fy2019.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:57:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:57:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CE07 119 KB
36 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7df3462f83fb056fb3a63ae58b58146ed709812948fc954f09aede85bcc1e37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1621855623965245"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37215
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:35 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame CE07 13 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4821fcf9c6131b5e09c316f6946b187f0b3751d723a19b2ff9f2df396d232cbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 120
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5621
x-xss-protection: 0
server: cafe
etag: 8169261014141303515
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:56:35 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame CE07 0
0 15ms
13ms Image
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQL8wDSIMN0Zsma2ujsqq3XnlLFjVf3Utvf9LegYLWKoPYqS-ABg2lrA7I78o0gw8lpvX-pKl-sXXcR0hWp3n0P64fkIA
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 4BD2 170 B
232 B 19ms
19ms Image
image/png 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBENujDxj4hKSmATAB&v=APEucNXUBW8-LmPR8WYojSMpB2ZUyiZsE9cJxriGRk2xBJ8OiGiYssqQbIMJ7lDs4HxG4W2sn2B89zYN9vG1cnSkfDkORg8b5zp530Pk46gujY6gLq8f29y8tWe8Va9qC1hgei-ae89nuuw_ImO26gZlRQNZJy7zZ_Zjc4F_1CwBFx3xWaC3whhHEbCK4iuQvKHndgeqzivOi6Es5M521BgyEvvMZVVQHd01w-9KO_w_iQP6fwhv4zo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4BD2
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjF6uQVPdMXTFmSxfCISAE&google_cver=1

43 B
1014 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjF6uQVPdMXTFmSxfCISAE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBENujDxj4hKSmATAB&v=APEucNXUBW8-LmPR8WYojSMpB2ZUyiZsE9cJxriGRk2xBJ8OiGiYssqQbIMJ7lDs4HxG4W2sn2B89zYN9vG1cnSkfDkORg8b5zp530Pk46gujY6gLq8f29y8tWe8Va9qC1hgei-ae89nuuw_ImO26gZlRQNZJy7zZ_Zjc4F_1CwBFx3xWaC3whhHEbCK4iuQvKHndgeqzivOi6Es5M521BgyEvvMZVVQHd01w-9KO_w_iQP6fwhv4zo
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:35 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:35 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:35 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEjF6uQVPdMXTFmSxfCISAE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4BD2
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YKzYW8JFpNqYPxopuCbkNgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1

43 B
1014 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNgBENujDxj4hKSmATAB&v=APEucNXUBW8-LmPR8WYojSMpB2ZUyiZsE9cJxriGRk2xBJ8OiGiYssqQbIMJ7lDs4HxG4W2sn2B89zYN9vG1cnSkfDkORg8b5zp530Pk46gujY6gLq8f29y8tWe8Va9qC1hgei-ae89nuuw_ImO26gZlRQNZJy7zZ_Zjc4F_1CwBFx3xWaC3whhHEbCK4iuQvKHndgeqzivOi6Es5M521BgyEvvMZVVQHd01w-9KO_w_iQP6fwhv4zo
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:36 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:36 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:36 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame CE07 176 KB
61 KB 24ms
5ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 08:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7657
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62241
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:47 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 08:50:58 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/elements/html/ Frame CE07 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A780PVDSPlaMVB5zHLo-WnshggTzNMtN-DqyLfkuwQr6epj9c6HStcIwk6PzppxkNYsCQbPyTRkYmiq3UfhkqKCSuGeHdo_pQXxrvu-7vDAzd4-zIDEf6eXVf_JiJ-qngw4a-0H8RSMx7eXSta9MSNurovfw&dbm_d=AKAmf-AvqiOTsez3vlFfp-i-HFHcI2y-9S6aBWP0LUHgDJT0E92Axl9-Jy1eXvu3eVTVTeFcqRJj2Yow9p8Ep2T5TU0nPX7pDIgiGXqWF4BsuVXdKwfvTvcLSremD_dku9Uw9DpyMGmfKIzIa5nf7ndSaACe_LdkxA-XDZ8seXmSWT8_e9FLnBai5db00yMjZ_pSsTmk-c2TcPn3i69Maa--gF63DUB-qad6qjGJlzy8XIqI84TuKPdf9usxMo4s6l3Z2f8k4-28C3CYKKmvdW7PDfeCqTOc3wnc1uF8uzUyYiYDrsTZMrZt9NBRwYaTJxmUKA4g8HEXKFC4fnWYk2UL6mICXo-MsPvDCmuXNIMs5oO60fOriC16QOSztiyLY-iDkNMHUguv-hSyjaCqo9MDf2LJSngUtjmNHiEwJdNfuB_aoCwIC1xv-CC4T_lD19faQs2WEaXzQTyAcgUnt3LPB7RSFyYL60BSMBSBYNqngEz6ZdgHwrcLWfsnXW8qOvHd9vw7j7mbl4xrx-h0Sh2-h8L9A_ifvndwMxS4NTjGyVswQkXipVXkCAqN6c55olRuITsX_ssPtgDEiDHGFOhF8y11ixZs8f8xJc3PDTMVkCrFXeBIohRVtSqRalurrOvt_OgSZE9FEQ-RftG2OJom5Fse1uMBwZOiDR-HHWWi9IylYwLmB55Em5t1RkhF38MKw6hvus5xslVoqsisxzuF6HNKmX4a8la9nxzFXAVpGjgFhbnEr5Fl-gP-tt7CgFKRuDhf4gUNurmVrwM-8P-o-bvbthW6KXsC2G0KX8ftAGR6V51ojQhjkx-nWrXXTsr-Sjbo1our5wH2QwxWHKX-2CD1ysaOrLnWJ5GAR_64KioEZ7tn-TUgrlWP-YKieiJyQgHoN9d6vxJ0zAawMLINJQoWkKnjeUc4lIosdw_hcf-Rv94Y22UNFyKYTweHL_fQH3zOq4CGQ8PrckcRzk8qCvPtHLaBlwS6aeMKb92KB6fcOUiLh4Dsu8c0K-9s0qIOgJpjK69YwTkvttbEwFcQWn3Q-5KbBx95D5rxW8UYgAmzo477xTKC8RsoLrH8CUsNh_iRF9BJj2rkC8gVhri1llbQ9Ip2mRJHXFB7R0YlnNKHsNqj70tsQpPaRn8t-zUl8XKsHk0blwfxaAcvs4xijuR3F0IPJNRHsdx7Gv5sDzwI6Ze8UGYuef7EpHTzU1Y3l0mDwfp2KHdAHxwNF79Gtb6Nvq1XbMCbKp_RUhrnefgpJwdjW1loG7KCBA-kJAU8_94CqkwMNHRvDgvW0Pu7hKHqdFdalaJAhYzl1j1lkH8AF9hYo34QaCDSCtuKYxagpaZvEW07GyUVYrAYYeruL_jC64BGHQWr1atlm5p_fz3Y-QEuZ49oGPZuRTrWg3onZw6ddsV-yXMLW9qx06-O38X51Pma4j3wUgGOun9Ndk0nfmXyZTRXu6kTcPEz8CuhQMzhIq53w-F9ErK7wi5nlJ--odvhyynQnyDrUgahNU0C-7sbVGIKHq_zc4NugfyCX0ZoyVXiSP66bVW3zO7WW2dqzYysBfIat603HHI8YAK8EtvyWdOe1_mJnzdd3GZFjCXXN9mULGmKA5dO5EZNLtk_phcCCQpNZo3AmNBXdk8KZiAjMoWnDf1wmWUlnYoXKNny-NpRhcuXApIc6veUsKLu1LIr3MDUZxiC1G9ubq41AxC9l6lyCZXkAnVuSSqpdF8vD0_rOfD6QJTa9HBLrcdpDaH1b_W07xWheiEMZGdo8nml7Pg113KipVKKQ15WvW3MTVd8RgXKkd7TDbKGnY8O1BPmQlhaNzvZVZRu16h7mc1p8hG_Ua-14DKiLPFyMh_dOvH3UPnLdKnTHDDcuLibnEEArY0cDNbyqWxUKG9rftDdvSYgCp7oeoMRT1oFZkZNGOoKGSSl5y2p8xRu_QPYVpi8xn1F7xgSyYKF4WNysjl4nRvkpLMv3xqUbAbcU6I5VFPaWeZKv_0BzBA8QBxgO3GxHNvCewIpyT1ZhouWFFj4HX6S4Io1B9Pq3-n--lrJE1PUUs9E_yLaoorFKyCIdPzQDzzE54rzYOwt9Lt3rV1M-KiWWG74yeXeLPmMuUa3zVEKBQf1m9evMbHCCzwGEees-iHNSMpeKf3NgODJ4zEe-0wL0Xv9r7FbBZvvnjLSPY--fBp9L3GQMYWQMeFf6srobTo7UfYIBMgknPHMj9EyRULHyQS02NBzWYKYNqyi4pmVVU_b8ymEkMeeEo19zI5zJnraouzJMji8WyvZXsAq2RzaTtTYG_tFT4B62lm5-VsNBziblBHfGRw3pj4CpxJFDE0IoqIrQgGZM3RRYugLQMCmST83_PIHWui7vp2FOZ8D_8_7P__3mEylRxuYLILq-Yp9fvRgWs7rY9wz9gs9RKUDRZ5P87c85NgzbDGJzulxEP2u7L_yY-KFQovV2q-EBLQeSHL5Ih4XMckj8KWmMCbHDDMUWGQtYExlrjmPqGEpvKfxKErp3ObFfJaOnnKJvYmQQm4efJDY8qCzCVL3ERJPP-WtKHTeXhqYvm1ucCbn4WJKCfiGFW2pLnDJ5nAsukuLNaN6vphHo5Oci_TJHYQQey3NApg4-D3lF5p5ygBQAXqWPRvCyR6Vc79frc2aUqJ4tdXwJO0qkjUCKZ0Le-yyewI8XNwiTiWNVI71yDiBVkH7oOtfEkh5f0kv_hHGZKwziId2Kuk3mDRf-Yj396fTABIOd--dsBbvFjgy-lIcIETVyVDd8yi7RPt3RTwlZS9oHAWZxdc5hI70DodDRVwuprv0QefhCztH2cfb8pOckj46zDIOIfC2Wxt0BE1lp4PSC7SmAMCs4oTLxuQNIKPhE6RukTBokuyDZnVlM4OsDbtwTFRqVhXFyMRABCbg9UxLLQtTqlAAkCPs51rDyxJQijdtl7C-S-vJSfZKpBXCorVcamNpn6g2EUSi84ozf2tv__RmcSiN1ZuwQ3Y_Z_SzpVoPC4YwWyOEstSJs3WJRfss9gmTXJJ_ncihFBb3e72bwzOMkFpicK43JDqefr4&cid=CAASFeRoij4nmvz1Q5XoRaurllJ9j_ud1g&rfl=1%2Chttps%253A%252F%252Ftrovas.ch%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:58:14 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/ Frame CE07 22 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4c0938e087a40c05a99d723eaf012958e03b048659bed9b36a2bc63f766d32b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:56:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8593
x-xss-protection: 0
server: cafe
etag: 3013172215444160546
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:56:52 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame CE07 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 05:20:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20280
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 May 2022 05:20:35 GMT

GET
DATA 200
OK truncated
/ Frame CE07 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 72c4a5664183c0a29103fd599491017a9df08536d72d46584fc6e4e4fa7be81f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 926C 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 25 May 2021 05:20:35 GMT
expires: Wed, 25 May 2022 05:20:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 20281
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 moatad.js Show response
z.moatads.com/essencedigitalemeav2553596143685/ Frame CE07 310 KB
104 KB 29ms
7ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/essencedigitalemeav2553596143685/moatad.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 925e7b29889fca17f5cf0b0f47ae3e3ffb37ffafa986c691fe188e9b568d49d6

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:36 GMT
content-encoding: gzip
last-modified: Thu, 13 May 2021 15:21:49 GMT
server: AmazonS3
x-amz-request-id: FMTYT50KGB5F8YZT
etag: "c730f42b038cc24be12d02f766cccdc2"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=37785
accept-ranges: bytes
content-length: 106263
x-amz-id-2: Xl/OvID9nI73l1jQsZkWYWsi6TU15hS+4KNoLiupQ1dey12TcHovKHvUyTJmeQ2kMqxcRa1K9sFNf+AJxjtfQw==

GET
H3-29 200 index.html Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/ Frame 5899 2 KB
637 B 28ms
15ms Document
text/html 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68394323f289509d072dcb45cbf8c4506147d49a53621740bd7065258f0bf9f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 612
date: Tue, 25 May 2021 10:58:36 GMT
expires: Wed, 26 May 2021 10:58:36 GMT
cache-control: public, max-age=86400
last-modified: Thu, 22 Apr 2021 14:11:44 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame CE07 0
61 B 53ms
53ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvdvC7Q0LaSD12l4yWWAlwPIXW_4UqKB0cQRAPCk79xSDovQNbNOHWbCYyjBDyUQiBa7l9LcNtYQ6oBZs2BI7K1x7RlJJ6ZirJkK1J1GMvwIWoXaP16j2jVldKHA3tZksvS2rpOxopVnTztlXKb7pWzW73cc1rhMyPgIcPXd4qsXrtiDyXrwTNFIgT_fl8_ztciDRcQTZ8qR6Fo4Yblc7adB7tsr133mMN-zBY3fN02w2zvj-VttPA5nRmK1HA6sd1oUdlxK6MOVR2QfYOHRX8fj_b5XiSQ-DOO3GctF2nxX-Xw6erD7S0f_nm2UaESrjecsYbGVHkuXdTucdcsSG1EwamzC2Or9BLIyXnEtvYG9MdTLIVm7-R9PgD31_G-QVj1aTm21QfjAgYeRkXgnXkjfKKr8GjM2Dl4SwJ5gPOMczau_Hl4SY7kEVYhejOSYpPJcKP7f2QiutHAIdC4BvxxCgwduoEaO2kj8I6L0DyVlGqnXIgdlyWde9lc5mVm_bXbt1IwZsj0AbOyE_iNr0n7BzQjM9-XG0YYhhALNkTvDtcuDD0XZnZxmKM5T7ZtyAJtB8hs9sxLOOH1WpOBKpcL4yJJpsTZ4rarFtXlqIq1KKsujhPioobCHzg64aaj0fxg5XoWu_o-xanz_hXacH7pMpxadmCJXlWjrn6CZ0tqvf2NED4WuNNAcKNgEH9rIb6PRXGXoP_dhLxdlt4PAOQCo2uLvtc-nzNjnTgwtg7MtyIL6S9zd3TO5vkh0k1EYdcv8Gp50EFjt_I8ghToU6YBnPPZrGqWTFZy2coWB4hq2GgpU-tVTWy-tCp5AZ150klpcm0oqW3FbwvKjQZZRiJUQjcgdLps3yrMLBzP08hR7No2Jha0xOOk4ilKW7-KVRySJNB6wMgqp0wCT5LqvATvQ_YuRFy-gkNCYkNQFwCcaoaWhVY-7aG0tt73__0eW7edi5fiXODz885iDMUwP6YVogweg6ZCSfgIoPO4ruz7Fev7RHzHm38xG_wjOm0VE7FBik4QnKKNk22Ymd0tAB5tqpdijntOLKYNLIA4haoEh9HihYkd5vDvFVZGLWT_JUchE8PPyK8WBQBB6pGHD-P8T03K-lQBY8rCgg4uJhj_eSTUA_C2Zv4_Gxob8GEB2Dtldobl3jg&sai=AMfl-YRdDTf_8ozTv8IJpxdGUmYYgZ80x6_unslqsKUzq8OHyGv6e_TkSH_rjtQ47LpjFL5tQkw7I6d_Vcgx3PhAPED_ryP6EYXr-QqbhM9XLOuKTCRuHRexy3_MdzChvNHohbLfkayZM_9rTBZdCYn2K9RbIahl9F2HaF3sp-M&sig=Cg0ArKJSzD4HMSCOGTTAEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=105&cbvp=1&cstd=99&cisv=r20210517.30862&adurl=

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 25 May 2021 10:58:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 beacon
tag.researchnow.com/t/ Frame CE07 42 B
442 B 30ms
7ms Image
image/gif 65.9.69.46
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tag.researchnow.com/t/beacon?pr=285717&adn=101&ca=25733733&si=6046251&pl=302186077&cr=149649403&did=&ord=597099191&gdpr=&gdpr_consent=&us_privacy=${US_PRIVACY}
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.69.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.46 () / PHP/7.2.34
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:44:52 GMT
via: 1.1 2fc0d20914c32e5cd76477ed042298d1.cloudfront.net (CloudFront)
server: Apache/2.4.46 ()
age: 824
x-powered-by: PHP/7.2.34
x-cache: Hit from cloudfront
p3p: CP='NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM'
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-amz-cf-pop: FRA56-C1
content-type: image/gif
content-length: 42
x-amz-cf-id: 3K3pljQ6Rojke1mYWfHoG9Jt4sX7bT4vkzHHAr2wBFntXOZpSDbuKw==
expires: 0

GET
H3-29 200 CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js Show response
pagead2.googlesyndication.com/bg/ Frame 926C 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096abd9dd93ed6879a4454b0e7e80392462e97bbeeff715de8ea45a0577470d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 19:06:10 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 09:08:00 GMT
server: sffe
age: 57146
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5728
x-xss-protection: 0
expires: Tue, 24 May 2022 19:06:10 GMT

GET
H2 200 n.js Show response
geo.moatads.com/ Frame CE07 125 B
300 B 96ms
34ms Script
text/html 34.249.226.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.moatads.com/n.js?e=35&ol=3324430317&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-1cQ31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-mQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=300&qe=250&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=ESSENCEDIGITALEMEA1&hp=1&pxm=3&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Ftrovas.ch&lp=https%3A%2F%2Ftrovas.ch&t=1621940316132&de=156590672549&m=0&ar=c498f16-clean&iw=4ce2857&q=2&cb=0&ym=0&cu=1621940316132&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=25733733%3A6046251%3A302186077%3A149649403&zMoatAUCID=-&zMoatENV=j&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Ftrovas.ch%2F&id=0&ii=3&bo=trovas.ch&bd=trovas.ch&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=essencedigitalemeav2553596143685&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A156%3A156%3A0%3A151&jk=-1&jm=-1&fs=191618&na=262205053&cs=0&callback=DOMlessLLDcallback_89904299
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/essencedigitalemeav2553596143685/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.226.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-226-229.eu-west-1.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: b80be3342a1227b4366f82d723279d82c5683e09c008fa153dac378d5b139373

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:36 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "f3ae70f79c79ae6b09101c840f2b062469077240"
content-length: 125
content-type: text/html; charset=UTF-8

GET
H2 200 v2 Show response
mb.moatads.com/s/ Frame CE07 148 B
323 B 990ms
942ms Script
text/html 18.132.66.136
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/s/v2?url=https%3A%2F%2Ftrovas.ch%2F&pcode=essencedigitalemeav2553596143685&callback=BrandSafetyNadoscallback_89904299
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/essencedigitalemeav2553596143685/moatad.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.132.66.136 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: TornadoServer/4.5.3 /
Resource Hash: 0b2c167a9995e3709b7854c8dad98f9afb2a92b3afd123d6c10f22a25e6b3698

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:37 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "e3ca0fc84dbd34b5c97dbc80b3440d1b0c306e65"
content-length: 148
content-type: text/html; charset=UTF-8

GET
H2 200 pixel.gif
px.moatads.com/ Frame CE07 43 B
260 B 10ms
8ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=17&i=ESSENCEDIGITALEMEA1&hp=1&pxm=3&sgs=3&vb=-1&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=1&nh=1&j=https%3A%2F%2Ftrovas.ch&lp=https%3A%2F%2Ftrovas.ch&t=1621940316132&de=156590672549&m=0&ar=c498f16-clean&iw=4ce2857&q=3&cb=0&ym=0&cu=1621940316132&ll=2&lm=1&ln=1&r=0&em=0&en=0&d=25733733%3A6046251%3A302186077%3A149649403&zMoatAUCID=-&zMoatENV=j&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Ftrovas.ch%2F&id=0&ii=3&bo=trovas.ch&bd=trovas.ch&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&gw=essencedigitalemeav2553596143685&fd=1&ac=1&it=500&ti=0&ih=1&pe=0%3A156%3A156%3A0%3A151&jk=-1&jm=-1&fs=191618&na=308512912&cs=0
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:36 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 25 May 2021 10:58:36 GMT

GET
H3-29 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 5899 110 KB
38 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 08:50:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7657
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 08:50:59 GMT

GET
H3-29 200 style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/ Frame 5899 3 KB
907 B 8ms
7ms Stylesheet
text/css 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/style.css

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

90ffc5dfb57b4b4ffc4352f499032a5a619b86e9d94168708d1bc888de7fa03b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 06:56:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14533
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 881
x-xss-protection: 0
last-modified: Thu, 22 Apr 2021 14:11:44 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 06:56:23 GMT

GET
H3-29 200 gsap_3.2.4_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5899 57 KB
23 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.2.4_min.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e8403779d45a9590b43c0ecf984ebe11e75fd2982630d658390a6001a6768770

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23276
x-xss-protection: 0
last-modified: Thu, 05 Mar 2020 03:53:22 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 10:58:36 GMT

GET
H3-29 200 preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 5899 55 KB
14 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

291fcf6b0aea583079f4ea7c943852ddd668ad895ee08b0b557b372040d205a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14120
x-xss-protection: 0
last-modified: Wed, 16 Mar 2016 13:51:39 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 10:58:36 GMT

GET
H3-29 200 cursor.png
s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/ Frame 5899 2 KB
2 KB 8ms
7ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/cursor.png

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b93a1462ddbc18a01f2fe80028efa0706b5452c590a819806f03ba6607f87023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 12:59:40 GMT
x-content-type-options: nosniff
last-modified: Thu, 22 Apr 2021 14:11:44 GMT
server: sffe
age: 79136
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1922
x-xss-protection: 0
expires: Tue, 25 May 2021 12:59:40 GMT

GET
H3-29 200 logic.js Show response
s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/ Frame 5899 19 KB
5 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/logic.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1540f9fa3d45d22876050360c88d20c83935b3faa8112eeef18e9da95b377019

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 06:50:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 14890
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4832
x-xss-protection: 0
last-modified: Thu, 22 Apr 2021 14:11:44 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 06:50:26 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame CE07 43 B
260 B 10ms
9ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&pxm=3&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=https%3A%2F%2Fs0.2mdn.net%2Fads%2Frichmedia%2Fstudio%2Fpv2%2F61763025%2F20210422071144607%2FChromebook_DE_Display_Q2_2021_EMEA_300x250%2Findex.html%3Fe%3D69%26leftOffset%3D0%26topOffset%3D0%26c%3DfpfA3RyoZY%26t%3D1%26renderingType%3D2&i=ESSENCEDIGITALEMEA1&ol=3324430317&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-1cQ31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-mQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=300&qe=250&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Ftrovas.ch%2F&id=0&ii=3&f=1&j=https%3A%2F%2Ftrovas.ch&lp=https%3A%2F%2Ftrovas.ch&t=1621940316132&de=156590672549&cu=1621940316132&m=72&ar=c498f16-clean&iw=4ce2857&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=250&le=1&gm=1&io=1&vv=3&vw=0%3A3%3A0&vp=-&vx=-%3A-%3A-&pe=0%3A156%3A156%3A0%3A151&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&ic=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=53&cd=0&ah=53&am=0&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=25733733%3A6046251%3A302186077%3A149649403&bo=trovas.ch&bd=trovas.ch&gw=essencedigitalemeav2553596143685&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatAUCID=-&zMoatENV=j&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&jk=-1&jm=-1&tc=0&fs=191618&na=1852292024&cs=0
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:36 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 25 May 2021 10:58:36 GMT

POST
H3-29 200 view
googleads4.g.doubleclick.net/pcs/ Frame CE07 0
23 B 58ms
42ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-29 200 4121_20210414091442078_300x250_Logo.png Show response
s0.2mdn.net/ads/richmedia/studio/4121/ Frame 5899 14 KB
14 KB 7ms
6ms XHR
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/4121/4121_20210414091442078_300x250_Logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03694a2bc84a28d9dfffed525b311fd71da1ac0c51d54d17fcdf34df0cd6ac94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Requested-With: XMLHttpRequest

Response headers

date: Tue, 25 May 2021 10:13:37 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 16:14:42 GMT
server: sffe
age: 2699
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
expires: Wed, 26 May 2021 10:13:37 GMT

GET
H3-29 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 5899 5 KB
4 KB 30ms
16ms XHR
application/json 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d24ce299fca2b1b81b86e0dbe4971e2ea8b9ff76c20543ad60343daa7e5a11ab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4128
x-xss-protection: 0

GET
H3-29 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 926C 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BH31CW9isYOWoOLeNjuwPtciB-AgAAAAAOAHgBAI&bg=!LS6lLmrNAAZ7hX_Ue4U7ACkAdvg8WhYq-QCxUn9D__NAkIft5jc8qQGsSdUJY3lUW_bxymjwx1WvYAIAAADSUgAAAAloAQcKAA54yj0aSVj4wPZZrQnvfZkCgpycJhbUCbK3ROy-4-ycjoxEfUw1MwvO0tXzz3d4YLU9plbSZu3iAsc19nFOD1Ek8ycn19nC3y6fo7Fyt0uF9_q-tovmr9sblS4YNjy0mXPc7x7TFQ5EOoqt3GxZuXStpqh2h4RvRsqibskTjvsRCMDJHnMGazT_KkzpAhN-S_EepvK3uQLpkQtn1KL7LabAKzfn18lh-0mILpj0HQrat8aIdzTk6baNUGjxb1hGn7VGjSczDtJrVHfN3vVO__iFC-2eralf6-yuY49hgrx34z8PTJ8YXmGbWMiUcLDq2VM_cHiX8A0pKeLsZLhnrBQD7fZ2-KRHbS8Qdb9Ub7VoRVExVn6sBDJcuO-vGkCW-42zJx7ERwXrsZLBDgb4zzwpy8GiIYn87NKri7gPhH8ZR-yWEOAe3qp3DUQUy2c0I6pYZGlTGrEAbZUrKFDNNj3OLktwVXAUdYMfOxJ5uS1gA8gm7DeWmUHzCvzTtcxUqVY7RZ3bOl6TKUfb5X3dTEy3vtCPMDePUcOLzGtFpX9BuQip87zcPCQ2gLsd_CGo3XPM1jrxm7CblRc9cuGf2218wcxJCEUh64pDnHuRY3QWuGkINhROi4jXI7ZYGKo0IYLq0f9hAqmECDQdeMKidhPfQ7B7-_yPNcH5kGzzDvEjt5uoFy2eSUjeE6LBlNEyS8jSuJ1HuwTRMxfRaeOF8SwHHTT68nryBcuorgTmXo1EplDMTIXeT9AD-rqQyDYufxmql9HaJlJXKv1U7FMQ5RjF4Buv_cT8P4CJX1jzqV4af7jEWIws_C4zDhjsxDHNYHZL-iBdDLc5w8L2KUR4iEUUbiuaDdM6fDnc4fBHbP82SzKmuQ

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame CE07 43 B
260 B 8ms
8ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&pxm=3&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=ESSENCEDIGITALEMEA1&ol=3324430317&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-1cQ31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-mQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=300&qe=250&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Ftrovas.ch%2F&id=0&ii=3&f=1&j=https%3A%2F%2Ftrovas.ch&lp=https%3A%2F%2Ftrovas.ch&t=1621940316132&de=156590672549&cu=1621940316132&m=208&ar=c498f16-clean&iw=4ce2857&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=250&le=1&lf=105&lg=1&lh=36&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A156%3A156%3A0%3A151&aa=0&ad=72&cn=0&gk=72&gl=0&ik=72&ic=72&ez=1&cq=1&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=53&cd=53&ah=53&am=53&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=25733733%3A6046251%3A302186077%3A149649403&bo=trovas.ch&bd=trovas.ch&gw=essencedigitalemeav2553596143685&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatAUCID=-&zMoatENV=j&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=-1&jm=-1&tc=0&fs=191618&na=1701193977&cs=0
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:36 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 25 May 2021 10:58:36 GMT

GET
BLOB 200
OK a7acae3c-7788-4506-896c-791fd6953dcb
https://s0.2mdn.net/ Frame 5899 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://s0.2mdn.net/a7acae3c-7788-4506-896c-791fd6953dcb
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03694a2bc84a28d9dfffed525b311fd71da1ac0c51d54d17fcdf34df0cd6ac94

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 14440
Content-Type: image/png

GET file.mp4
gcdn.2mdn.net/videoplayback/id/07ae977081b51685/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/ip,ipbits,expire,id,itag,sour... Frame 5899 0
0

GET
H3-29 200 4121_20201103081316725_pixel.png Show response
s0.2mdn.net/ads/richmedia/studio/4121/ Frame 5899 954 B
978 B 6ms
6ms XHR
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/4121/4121_20201103081316725_pixel.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3cbdfa337867e30c33a15837b190a3e9660915452f9f797b78efb7c90f78c18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Requested-With: XMLHttpRequest

Response headers

date: Mon, 24 May 2021 12:59:25 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Nov 2020 16:13:16 GMT
server: sffe
age: 79151
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 954
x-xss-protection: 0
expires: Tue, 25 May 2021 12:59:25 GMT

GET
H3-29 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 5899 17 KB
6 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1616005470650935"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6437
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:36 GMT

GET
BLOB 200
OK 1025a0cc-f674-4d43-81d8-7f9dec815fad
https://s0.2mdn.net/ Frame 5899 954 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: blob:https://s0.2mdn.net/1025a0cc-f674-4d43-81d8-7f9dec815fad
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3cbdfa337867e30c33a15837b190a3e9660915452f9f797b78efb7c90f78c18

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 954
Content-Type: image/png

GET
H3-29 200 GoogleSans-Regular.ttf Show response
s0.2mdn.net/creatives/assets/3658020/ Frame 5899 154 KB
75 KB 7ms
7ms XHR
font/ttf 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3658020/GoogleSans-Regular.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8914b020e2c78fe86ca14198095455139f08047b8b52ab69003cb5af35cbbc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Requested-With: XMLHttpRequest

Response headers

date: Tue, 25 May 2021 10:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 354
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 76807
x-xss-protection: 0
last-modified: Wed, 19 Feb 2020 16:45:50 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 11:07:42 GMT

GET
H3-29 200 GoogleSans-Medium.ttf Show response
s0.2mdn.net/creatives/assets/3658020/ Frame 5899 154 KB
75 KB 7ms
7ms XHR
font/ttf 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3658020/GoogleSans-Medium.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e72f9df72eddef9a75aa93b0972c35491bab52d65c32714fe004b75bd7b5271

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Requested-With: XMLHttpRequest

Response headers

date: Tue, 25 May 2021 10:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 600
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77158
x-xss-protection: 0
last-modified: Wed, 19 Feb 2020 16:45:44 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 11:03:36 GMT

GET
H3-29 200 CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js Show response
pagead2.googlesyndication.com/bg/ Frame EC3D 14 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096abd9dd93ed6879a4454b0e7e80392462e97bbeeff715de8ea45a0577470d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 19:06:10 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 09:08:00 GMT
server: sffe
age: 57146
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5728
x-xss-protection: 0
expires: Tue, 24 May 2022 19:06:10 GMT

GET
H3-29 200 GoogleSans-Bold.ttf Show response
s0.2mdn.net/creatives/assets/3658020/ Frame 5899 154 KB
76 KB 7ms
7ms XHR
font/ttf 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3658020/GoogleSans-Bold.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/preloadjs_0.6.2_d7b96570d4552592ae479162e546cb25_min.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

804fdad80c0a5bf7ea7a2396f7368abbcb4d948f31f0ac88b199dc4c18ef3391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
X-Requested-With: XMLHttpRequest

Response headers

date: Tue, 25 May 2021 10:51:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 410
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77522
x-xss-protection: 0
last-modified: Wed, 19 Feb 2020 16:45:15 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 11:06:46 GMT

GET
H3-29 200 GoogleSans-Bold.ttf
s0.2mdn.net/creatives/assets/3658020/ Frame 5899 154 KB
76 KB 6ms
6ms Font
font/ttf 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3658020/GoogleSans-Bold.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/style.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

804fdad80c0a5bf7ea7a2396f7368abbcb4d948f31f0ac88b199dc4c18ef3391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:51:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 410
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 77522
x-xss-protection: 0
last-modified: Wed, 19 Feb 2020 16:45:15 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 11:06:46 GMT

GET
H3-29 200 GoogleSans-Regular.ttf
s0.2mdn.net/creatives/assets/3658020/ Frame 5899 154 KB
75 KB 8ms
8ms Font
font/ttf 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3658020/GoogleSans-Regular.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/style.css

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8914b020e2c78fe86ca14198095455139f08047b8b52ab69003cb5af35cbbc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:52:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 354
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 76807
x-xss-protection: 0
last-modified: Wed, 19 Feb 2020 16:45:50 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 11:07:42 GMT

GET
H3-29 200 4121_20210414091442078_300x250_Logo.png
s0.2mdn.net/ads/richmedia/studio/4121/ Frame 5899 14 KB
14 KB 6ms
6ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/4121/4121_20210414091442078_300x250_Logo.png

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03694a2bc84a28d9dfffed525b311fd71da1ac0c51d54d17fcdf34df0cd6ac94

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:13:37 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Apr 2021 16:14:42 GMT
server: sffe
age: 2699
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14440
x-xss-protection: 0
expires: Wed, 26 May 2021 10:13:37 GMT

GET
H3-29 200 4121_20201103081316725_pixel.png
s0.2mdn.net/ads/richmedia/studio/4121/ Frame 5899 954 B
978 B 7ms
6ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/4121/4121_20201103081316725_pixel.png

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3cbdfa337867e30c33a15837b190a3e9660915452f9f797b78efb7c90f78c18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61763025/20210422071144607/Chromebook_DE_Display_Q2_2021_EMEA_300x250/index.html?e=69&leftOffset=0&topOffset=0&c=fpfA3RyoZY&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 12:59:25 GMT
x-content-type-options: nosniff
last-modified: Tue, 03 Nov 2020 16:13:16 GMT
server: sffe
age: 79151
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 954
x-xss-protection: 0
expires: Tue, 25 May 2021 12:59:25 GMT

GET
H/1.1

206
Partial Content

file.mp4
r4---sn-4g5ednly.c.2mdn.net/videoplayback/id/07ae977081b51685/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ip... Frame 5899
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/07ae977081b51685/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/ip,ipbits,expire,id,i...
https://r4---sn-4g5ednly.c.2mdn.net/videoplayback/id/07ae977081b51685/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,...

160 KB
0

20ms
7ms

Media
video/mp4

2a00:1450:4001:67::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5ednly.c.2mdn.net/videoplayback/id/07ae977081b51685/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ipbits,itag,mh,mime,mip,mm,mn,ms,mv,mvi,pl,ratebypass,requiressl,source/signature/2069401A346987A8BCE1F8CB931BFC5808366D96.355CE95E4BB450C4EB9EAA441BC35B385DFD197D/key/cms1/cms_redirect/yes/mh/r0/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednly/ms/onc/mt/1621939948/mv/m/mvi/4/pl/50/file/file.mp4

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:67::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:36 GMT
X-Content-Type-Options: nosniff
Last-Modified: Tue, 20 Apr 2021 11:34:57 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-474672/474673
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 474673
Expires: Tue, 25 May 2021 10:58:36 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:36 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r4---sn-4g5ednly.c.2mdn.net/videoplayback/id/07ae977081b51685/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ipbits,itag,mh,mime,mip,mm,mn,ms,mv,mvi,pl,ratebypass,requiressl,source/signature/2069401A346987A8BCE1F8CB931BFC5808366D96.355CE95E4BB450C4EB9EAA441BC35B385DFD197D/key/cms1/cms_redirect/yes/mh/r0/mip/2a01:4f8:192:5414::2/mm/42/mn/sn-4g5ednly/ms/onc/mt/1621939948/mv/m/mvi/4/pl/50/file/file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 693
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 206 file.mp4
r4---sn-4g5ednly.c.2mdn.net/videoplayback/id/07ae977081b51685/itag/15/source/doubleclick/requiressl/yes/ratebypass/yes/mime/video%2Fmp4/ip/0.0.0.0/ipbits/0/expire/2144448000/sparams/expire,id,ip,ip... Frame 5899 260 KB
0 14ms
6ms Media
video/mp4 2a00:1450:4001:67::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:67::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://s0.2mdn.net/
Accept-Encoding: identity;q=1, *;q=0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Range: bytes=163840-

Response headers

date: Tue, 25 May 2021 10:58:36 GMT
x-content-type-options: nosniff
last-modified: Tue, 20 Apr 2021 11:34:57 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
Content-Range: bytes 163840-474672/474673
client-protocol: quic
cache-control: private, max-age=86400
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 310833
expires: Tue, 25 May 2021 10:58:36 GMT

GET
H3-29 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CE07 42 B
64 B 41ms
40ms Fetch
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssKmwbbB_0M6BtiISRg7lLJy4XWPv4o4KDAGeudF4Fxg06i2PBZ_E6g9Yu0_QXAYZLd2r3TVrqE0mu1Iz59C9d3GcHq72OgFk7zQi-Ka-wbyLji&sai=AMfl-YS00ycgW-Zp2pB20Y-UYjCRQD1YJm5NcPDS4K7J7pIxwJempwrdwh4yFfpkF2KNpstGxdg60pAMzK0KFaGDsoM8PJARUpQerfImA4sg9UEJNV7GdYM3CToc2S81bVw&sig=Cg0ArKJSzEAtLXKrl2GzEAE&cid=CAASFeRoij4nmvz1Q5XoRaurllJ9j_ud1g&id=lidar2&mcvt=1000&p=171,974,421,1274&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20210524&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3122676338&rs=4&met=ce&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ%3D%3D&vs=4&rst=1621940315896&dlt=9&rpt=152&isd=0&msd=0&r=v&fum=1

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
65 B 8ms
8ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ2aWV3ZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: __gads=ID=23d3f965baeb32e6-2285b8c01ec8004b:T=1621940315:S=ALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA; ezouspvv=350; ezouspva=1; ezouspvh=350
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:37 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:37 UTC

GET
H/1.1 200
OK pixel.gif
essencedigitalemea2015301593033067.s.moatpixel.com/ Frame CE07 43 B
419 B 68ms
25ms Image
image/gif 104.108.145.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essencedigitalemea2015301593033067.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=53&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=trovas.ch&L1id=25733733&L2id=6046251&L3id=302186077&L4id=149649403&S1id=trovas.ch&S2id=trovas.ch&ord=1621940316132&r=156590672549&t=meas&os=0&fi2=0&div1=0&ait=0&zMoatAUCID=&bedc=1&vat=0&bedc=1&q=1&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:37 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:37 GMT

GET
H/1.1 200
OK pixel.gif
essencedigitalemea2015301593033067.s.moatpixel.com/ Frame CE07 43 B
419 B 84ms
26ms Image
image/gif 104.108.145.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essencedigitalemea2015301593033067.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=0&fi=0&apd=53&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=trovas.ch&L1id=25733733&L2id=6046251&L3id=302186077&L4id=149649403&S1id=trovas.ch&S2id=trovas.ch&ord=1621940316132&r=156590672549&t=bs&os=0&fi2=0&div1=0&ait=0&zMoatAUCID=&bedc=1&vat=0&bedc=1&q=2&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:37 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:37 GMT

GET
H/1.1 200
OK pixel.gif
essencedigitalemea2015301593033067.s.moatpixel.com/ Frame CE07 43 B
419 B 83ms
26ms Image
image/gif 104.108.145.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essencedigitalemea2015301593033067.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=72&fi=1&apd=197&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=trovas.ch&L1id=25733733&L2id=6046251&L3id=302186077&L4id=149649403&S1id=trovas.ch&S2id=trovas.ch&ord=1621940316132&r=156590672549&t=hdn&os=1&fi2=0&div1=0&ait=0&zMoatAUCID=&bedc=1&vat=0&bedc=1&q=3&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:37 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:37 GMT

GET
H/1.1 200
OK pixel.gif
essencedigitalemea2015301593033067.s.moatpixel.com/ Frame CE07 43 B
419 B 90ms
28ms Image
image/gif 104.108.145.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essencedigitalemea2015301593033067.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=72&fi=1&apd=197&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=trovas.ch&L1id=25733733&L2id=6046251&L3id=302186077&L4id=149649403&S1id=trovas.ch&S2id=trovas.ch&ord=1621940316132&r=156590672549&t=fv&os=1&fi2=0&div1=0&ait=0&zMoatAUCID=&bedc=1&vat=0&bedc=1&q=4&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:37 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:37 GMT

GET
H/1.1 200
OK pixel.gif
essencedigitalemea2015301593033067.s.moatpixel.com/ Frame CE07 43 B
419 B 90ms
29ms Image
image/gif 104.108.145.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essencedigitalemea2015301593033067.s.moatpixel.com/pixel.gif?m=1&iv=0&tuv=-1&tet=72&fi=1&apd=197&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=trovas.ch&L1id=25733733&L2id=6046251&L3id=302186077&L4id=149649403&S1id=trovas.ch&S2id=trovas.ch&ord=1621940316132&r=156590672549&t=nht&os=1&fi2=0&div1=0&ait=0&zMoatAUCID=&bedc=1&vat=0&bedc=1&q=5&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:37 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:37 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame CE07 43 B
260 B 8ms
7ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&pxm=3&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=ESSENCEDIGITALEMEA1&ol=3324430317&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-1cQ31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-mQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=300&qe=250&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Ftrovas.ch%2F&id=0&ii=3&f=1&j=https%3A%2F%2Ftrovas.ch&lp=https%3A%2F%2Ftrovas.ch&t=1621940316132&de=156590672549&cu=1621940316132&m=1214&ar=c498f16-clean&iw=4ce2857&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=250&le=1&lf=105&lg=1&lh=36&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A156%3A156%3A1386%3A151&aa=1&ad=1078&cn=72&gn=1&gk=1078&gl=72&ik=1078&ic=1078&ez=1&co=1078&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1003&cd=53&ah=1003&am=53&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=25733733%3A6046251%3A302186077%3A149649403&bo=trovas.ch&bd=trovas.ch&gw=essencedigitalemeav2553596143685&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatAUCID=-&zMoatENV=j&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191618&na=1013902793&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:37 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 25 May 2021 10:58:37 GMT

GET
H/1.1 200
OK pixel.gif
essencedigitalemea2015301593033067.s.moatpixel.com/ Frame CE07 43 B
419 B 24ms
24ms Image
image/gif 104.108.145.172
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://essencedigitalemea2015301593033067.s.moatpixel.com/pixel.gif?m=1&iv=1&tuv=1003&tet=1078&fi=1&apd=1203&ui=0&uit=0&h=0&th=-1&s=-1&ts=-1&bfa=-1&d=trovas.ch&L1id=25733733&L2id=6046251&L3id=302186077&L4id=149649403&S1id=trovas.ch&S2id=trovas.ch&ord=1621940316132&r=156590672549&t=iv&os=1&fi2=0&div1=1&ait=0&zMoatAUCID=&bedc=1&vat=0&bedc=1&q=6&BSD=safe&BSC=moat_unsure&nu=1&ib=0&dc=1&ob=1&oh=1&lt=0&ab=1&n=1&nm=1&sp=0&pt=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.145.172 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:37 GMT
Last-Modified: Fri, 20 May 2016 15:16:00 GMT
Server: AkamaiNetStorage
ETag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:37 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame CE07 43 B
260 B 8ms
8ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&pxm=3&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=ESSENCEDIGITALEMEA1&ol=3324430317&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-1cQ31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-mQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=300&qe=250&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Ftrovas.ch%2F&id=0&ii=3&f=1&j=https%3A%2F%2Ftrovas.ch&lp=https%3A%2F%2Ftrovas.ch&t=1621940316132&de=156590672549&cu=1621940316132&m=1215&ar=c498f16-clean&iw=4ce2857&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=250&le=1&lf=105&lg=1&lh=36&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A156%3A156%3A1386%3A151&aa=1&ad=1078&cn=1078&gn=1&gk=1078&gl=1078&ik=1078&ic=1078&ez=1&co=1078&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1003&cd=1003&ah=1003&am=1003&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=25733733%3A6046251%3A302186077%3A149649403&bo=trovas.ch&bd=trovas.ch&gw=essencedigitalemeav2553596143685&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatAUCID=-&zMoatENV=j&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191618&na=1644338079&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:37 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 25 May 2021 10:58:37 GMT

GET
H2 200 pixel.gif
px.moatads.com/ Frame CE07 43 B
260 B 10ms
10ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=37&q=2&hp=1&pxm=3&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=ESSENCEDIGITALEMEA1&ol=3324430317&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-1cQ31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-mQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=300&qe=250&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Ftrovas.ch%2F&id=0&ii=3&f=1&j=https%3A%2F%2Ftrovas.ch&lp=https%3A%2F%2Ftrovas.ch&t=1621940316132&de=156590672549&cu=1621940316132&m=1216&ar=c498f16-clean&iw=4ce2857&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=250&le=1&lf=105&lg=1&lh=36&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A156%3A156%3A1386%3A151&aa=1&ad=1078&cn=1078&gn=1&gk=1078&gl=1078&ik=1078&ic=1078&ez=1&co=1078&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1003&cd=1003&ah=1003&am=1003&xd=00&rf=0&re=1&wb=1&cl=0&at=0&d=25733733%3A6046251%3A302186077%3A149649403&bo=trovas.ch&bd=trovas.ch&gw=essencedigitalemeav2553596143685&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatAUCID=-&zMoatENV=j&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=5&jm=-1&tc=0&fs=191618&na=1025155424&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:37 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 25 May 2021 10:58:37 GMT

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 10ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6IlszMDAsMjUwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzcifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfc2l6ZSIsInZhbCI6IlszMDAsMjUwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzcifV0sImlzX29yaWciOmZhbHNlfV0=
pragma: no-cache
cookie: __gads=ID=23d3f965baeb32e6-2285b8c01ec8004b:T=1621940315:S=ALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA; ezouspvv=350; ezouspva=1; ezouspvh=350
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:37 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:37 UTC

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 15ms
14ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 429 B
250 B 443ms
443ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=69885411941960&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=4&rcs=1&prev_scp=a%3D%257C3%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3D9ae587f95e95c876b7b76fd4c72a3838%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D180%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D32%2C13%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C20%26lb%3D350%26reqt%3D1621940318596&eri=1&cookie=ID%3D23d3f965baeb32e6-2285b8c01ec8004b%3AT%3D1621940315%3AS%3DALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA&bc=31&abxe=1&lmt=1621940318&dt=1621940318601&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=639&adys=171&adks=3122676339&ucis=5&ifi=5&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8eac93cdab3404028af78811680d4d2acd69d67dce7bd2aa69ec1b8c2b7501b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:39 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 221
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 429 B
250 B 359ms
359ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=2342644157096539&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=4&rcs=1&prev_scp=a%3D%257C251%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3D9ae587f95e95c876b7b76fd4c72a3838%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D180%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D32%2C13%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C20%26lb%3D350%26reqt%3D1621940318603&eri=1&cookie=ID%3D23d3f965baeb32e6-2285b8c01ec8004b%3AT%3D1621940315%3AS%3DALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA&bc=31&abxe=1&lmt=1621940318&dt=1621940318606&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=171&adks=840336167&ucis=6&ifi=6&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4534e7ddeaa367749e5c939c83ba735e30089d1f0c6a09a596db800f77a0dca0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:38 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 221
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 437 B
258 B 483ms
483ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=447377750737684&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=4&rcs=1&prev_scp=a%3D%257C252%257C%26iid5%3D456778%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dtrovas_ch-medrectangle-2-456778%26eb_br%3D6e85b37de1b1ffc2593baa5d6e4b02fc%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D450%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%26lb%3D900%26reqt%3D1621940318608&eri=1&cookie=ID%3D23d3f965baeb32e6-2285b8c01ec8004b%3AT%3D1621940315%3AS%3DALNI_MbpIr-gEJacMzwDrgsat5GA_vOxuA&bc=31&abxe=1&lmt=1621940318&dt=1621940318611&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1108&adks=2530142577&ucis=7&ifi=7&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57f2782f4cef8015b7b8d940dbf8941631d5af0b5b8af878a4fd0cdb50adec17

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:39 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 229
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 26ms
24ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 25ms
23ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 331 B
164 B 321ms
320ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=4000083787791464&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=a%3D%257C3%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D100%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D32%2C13%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C20%2C17%2C20%26lb%3D180%26reqt%3D1621940319113&eri=1&cookie=ID%3D23d3f965baeb32e6%3AT%3D1621940315%3AS%3DALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw&bc=31&abxe=1&lmt=1621940320&dt=1621940320119&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=639&adys=171&adks=3122676339&ucis=8&ifi=8&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

502d568a0a80350d6a3f540b4b7222cceeb020757d35a4f7fe881d37a25ce08a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 331 B
164 B 206ms
206ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=2339931714358490&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=2&rcs=2&prev_scp=a%3D%257C251%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3Da495ce7dbb4cefcd3e0a722048894f41%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D100%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D32%2C13%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C20%2C17%2C20%26lb%3D180%26reqt%3D1621940319114&eri=1&cookie=ID%3D23d3f965baeb32e6%3AT%3D1621940315%3AS%3DALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw&bc=31&abxe=1&lmt=1621940320&dt=1621940320122&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=171&adks=840336167&ucis=9&ifi=9&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

52c6023a3e9981082744f88ac29be97a7473409becbc4922777c59810b33919d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 135
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 339 B
172 B 285ms
284ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=218652175625231&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=2&rcs=2&prev_scp=a%3D%257C252%257C%26iid5%3D456778%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dtrovas_ch-medrectangle-2-456778%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D160%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C20%26lb%3D450%26reqt%3D1621940319130&eri=1&cookie=ID%3D23d3f965baeb32e6%3AT%3D1621940315%3AS%3DALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw&bc=31&abxe=1&lmt=1621940320&dt=1621940320134&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1108&adks=2530142577&ucis=a&ifi=10&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

24887451de2a1ef0c381aaff6a00ace3c4770db7e4e7214e8ec6d4405ed0ed5e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
65 B 10ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiI3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjY5MzkiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtYm94LTItMF8yIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMjYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ1Njc3OCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjExOCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiI3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjY5MzkiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtYm94LTItMF8yIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMjYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ1Njc3OCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjExOCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: ezouspvv=350; ezouspva=1; ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 9ms
8ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzMTUifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjE3MSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI2MzkifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjE3MSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI5NjIifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjE3MSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ1Njc3OCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTEwMCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoidHJ1ZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzMTUifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjE3MSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI2MzkifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjE3MSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiI5NjIifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjE3MSJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ1Njc3OCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiMTEwMCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoidHJ1ZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: ezouspvv=350; ezouspva=1; ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 339 B
172 B 313ms
312ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=2857027452850083&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-medrectangle-3&enc_prev_ius=%2F0%2F1&prev_iu_szs=468x60&prev_scp=a%3D%257C124%257C%26iid5%3D498439%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1116%26sap%3D1116%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D21%26al%3D1021%26compid%3D0%26tap%3Dtrovas_ch-medrectangle-3-498439%26eb_br%3D26dfa00588543c52511429ade391f561%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D15%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26br1%3D550%26br2%3D280%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C988&eri=1&cookie=ID%3D23d3f965baeb32e6%3AT%3D1621940315%3AS%3DALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw&bc=31&abxe=1&lmt=1621940320&dt=1621940320543&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=566&adys=1675&adks=1704400173&ucis=b&ifi=11&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=984x60&msz=468x60&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

6d927a2fd532c61b1a81975071b0cc074d99e0ba6177a04963bb53941019d7d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 70ms
24ms Preflight
application/json 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ftrovas.ch%2F&domain=trovas.ch&cw=1

Protocol

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: https://trovas.ch
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: https://trovas.ch
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1453
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Ftrovas.ch%2F&domain=trovas.ch&cw=1
https://mug.criteo.com/sid?cpp=oA8kFnxkeERCbDVlSGRhM0c4MFMrVmo4bzc4MlJNOU16cnp0dFRML1FCdTk4QjhCSk9hU0hCbTRyK0ozT1U3a1AxQitUS2FOQmtzNlgzbndETE1KdnVRa1JQUjRrWmpMN1dKNk0xeDhnOEpCYWs2SktvUFlCK1g2YlJYNW...

361 B
639 B

50ms
18ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=oA8kFnxkeERCbDVlSGRhM0c4MFMrVmo4bzc4MlJNOU16cnp0dFRML1FCdTk4QjhCSk9hU0hCbTRyK0ozT1U3a1AxQitUS2FOQmtzNlgzbndETE1KdnVRa1JQUjRrWmpMN1dKNk0xeDhnOEpCYWs2SktvUFlCK1g2YlJYNW15VVc3YXM4SzhlT2RQSVRUUks2YjkyQ2VRb1kwaHFmLzJyOTAvNTd4Vmt2TW9CeDZiUDlJK04xb3JuVEFpckNFL2FyM3BOOXFGV0N6OHkyaDNHaWQvMHBvYXllMHBlamNHeml4V0k2NnJ4K0o0RUJld0lrPXw&cppv=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

949091e705bcbbdc9ddc38292ae082d513da49e550d5ae5897cd10341e6c6929

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
content-encoding: gzip
date: Tue, 25 May 2021 10:58:40 GMT
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2431
expires: 0

Redirect headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 25 May 2021 10:58:39 GMT
location: https://mug.criteo.com/sid?cpp=oA8kFnxkeERCbDVlSGRhM0c4MFMrVmo4bzc4MlJNOU16cnp0dFRML1FCdTk4QjhCSk9hU0hCbTRyK0ozT1U3a1AxQitUS2FOQmtzNlgzbndETE1KdnVRa1JQUjRrWmpMN1dKNk0xeDhnOEpCYWs2SktvUFlCK1g2YlJYNW15VVc3YXM4SzhlT2RQSVRUUks2YjkyQ2VRb1kwaHFmLzJyOTAvNTd4Vmt2TW9CeDZiUDlJK04xb3JuVEFpckNFL2FyM3BOOXFGV0N6OHkyaDNHaWQvMHBvYXllMHBlamNHeml4V0k2NnJ4K0o0RUJld0lrPXw&cppv=2
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1857
content-length: 482
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 608 B
1 KB 175ms
149ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

ddbd9d259b467839bd0916dad190010dd5db08661b56d65e2869cdff845a0041

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 25 May 2021 10:58:40 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.220.70.226; 185.220.70.226; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.221.10:80
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 26359816-4785-4e4e-a43d-7246f5c59333
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://trovas.ch
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 mvo Show response
tag.1rx.io/rmp/215626/0/ 0
165 B 46ms
16ms XHR
text/plain 213.19.147.42
RHYTHMONE

General

Check archive.org

Show headers Download Go to

Full URL: https://tag.1rx.io/rmp/215626/0/mvo?z=1r&hbv=4.27,2.1
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.19.147.42 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://trovas.ch
pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true
server: Tengine

POST
H2 200 auction Show response
rtb.adxpremium.services/openrtb2/ 324 B
878 B 98ms
83ms XHR
application/json 2606:4700:e0::ac40:631d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adxpremium.services/openrtb2/auction
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e0::ac40:631d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c912c2adfb765ff55fa1ebe8c78e1b51d15dc6401fe2078933d3716b884dd8f

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","max_age":604800}
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 0a44c6515900004eaf8e350000000001
pragma: no-cache
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v2?s=HPniBB0%2FPYR5J4QzebHBS2RmF6Zdyorm%2F9Y5zb82U41G6Wc%2FtcEmX5IiTvrTemD3iAsn9v5o9kA%2BzbnPX8BDQizA9yooQOr7a5PoxkZEBVBqGrbeyv%2FUFAEX%2Bk7tzFUoDKaYDozLlT%2FF4deEprzMFGg%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cf-ray: 654e3ffbcc014eaf-FRA
expires: 0

POST
H2 200 c Show response
prebid.a-mo.net/a/ 861 B
780 B 330ms
141ms XHR
application/json 136.144.59.88
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 136.144.59.88 Secaucus, United States, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: 066392b2431981957c843b54365c834ccffa3bb6af8d3b5365e4d0ad5228db9c

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
server: envoy
vary: origin, accept-encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: https://trovas.ch
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 47
content-length: 355

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 605 B
1 KB 52ms
27ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

87e3acce7b16038355a02bf2e1da3475cc21e9276810fab0a8c1574186af3aad

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 25 May 2021 10:58:40 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.220.70.226; 185.220.70.226; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.58:80
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: ca06484e-219f-4ca5-a881-09f3bbfb3231
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://trovas.ch
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
139 B 43ms
15ms XHR
text/plain 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.27.0&cb=94027606240
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS: bidder.am5.vip.prod.criteo.com
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://trovas.ch
date: Tue, 25 May 2021 10:58:40 GMT
access-control-allow-credentials: true
server: Finatra
timing-allow-origin: *
vary: Origin

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 136ms
81ms XHR
application/json 213.19.162.21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=15&rp_schain=1.0,1!ezoic.ai,3da3e69ce47e1061b794efc8073d4adf,1,,,&rf=https%3A%2F%2Ftrovas.ch%2F&tk_flint=pbjs_lite_v4.27.0&x_source.tid=e5c11bcd-1630-4c35-9fc7-9faf0be30ccb&p_screen_res=1600x1200&rp_secure=1&slots=1&rand=0.8469594928752495
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 213.19.162.21 , United Kingdom, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 1e231d02caa774e9d64645375f272a48d84f4bf1244616b015066797612097de

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:40 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://trovas.ch
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 3 KB
3 KB 154ms
100ms XHR
application/json 213.19.162.21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=15&rp_schain=1.0,1!ezoic.ai,3da3e69ce47e1061b794efc8073d4adf,1,,,&rf=https%3A%2F%2Ftrovas.ch%2F&tk_flint=pbjs_lite_v4.27.0&x_source.tid=4a96a547-4e34-477e-8989-98e9598f8125&p_screen_res=1600x1200&rp_secure=1&slots=1&rand=0.6214665485792417
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 213.19.162.21 , United Kingdom, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: d1f84e5156538bbcb339739fa325fa3f61bc722b5875e67f1cde3984f2edbdb8

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:40 GMT
Content-Encoding: gzip
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://trovas.ch
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 1464
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
2 KB 127ms
71ms XHR
application/json 213.19.162.21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=15&rp_schain=1.0,1!ezoic.ai,3da3e69ce47e1061b794efc8073d4adf,1,,,&rf=https%3A%2F%2Ftrovas.ch%2F&tk_flint=pbjs_lite_v4.27.0&x_source.tid=635cd366-95d1-456c-bbce-11d880c8496f&p_screen_res=1600x1200&rp_secure=1&slots=1&rand=0.6225932653330706
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 213.19.162.21 , United Kingdom, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: a2e5f774839dd9a103d1b2181568998408a85f9b837c7f3676c1377e567aa7d8

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:40 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://trovas.ch
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 240 B
2 KB 142ms
83ms XHR
application/json 213.19.162.21
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=1&rp_schain=1.0,1!ezoic.ai,3da3e69ce47e1061b794efc8073d4adf,1,,,&rf=https%3A%2F%2Ftrovas.ch%2F&tk_flint=pbjs_lite_v4.27.0&x_source.tid=4ae98605-169a-428d-b798-6523ccfd2498&p_screen_res=1600x1200&rp_secure=1&slots=1&rand=0.16608323668746627
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?b=amx,appnexus,criteo,luponmedia,oftmedia,pubmatic,rhythmone,rubicon&cb=194-4-19
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 213.19.162.21 , United Kingdom, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: c4a1b3bfb919c3546d1306198637a2e0cab2636333097803c2caad46b9f16810

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:40 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://trovas.ch
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Keep-Alive: timeout=5
Content-Length: 240
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H3-29 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 22ms
21ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 17ms
15ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=trovas.ch

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 232ms
232ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=785513471751557&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=3&prev_scp=a%3D%257C3%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3D947f1d5169cc7d0f997560e34838fb04%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D42%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D1%26stl%3D32%2C13%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C20%2C17%2C20%2C17%2C19%2C20%26lb%3D100%26reqt%3D1621940320629&eri=1&cookie=ID%3D23d3f965baeb32e6%3AT%3D1621940315%3AS%3DALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw&bc=31&abxe=1&lmt=1621940320&dt=1621940320634&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=639&adys=171&adks=3122676339&ucis=c&ifi=12&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

790d0cd690a2aea1fa5b3b4ef1ee3fff06b2792333ef147e252052686a3586d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9836
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 272ms
271ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=503206882295099&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ris=1&rcs=3&prev_scp=a%3D%257C251%257C%26iid5%3D466939%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1126%26sap%3D1126%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dtrovas_ch-box-2-466939%26eb_br%3D947f1d5169cc7d0f997560e34838fb04%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D5%26bvm%3D0%26bvr%3D5%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D42%26br2%3D550%26ezoic%3D1%26nmau%3D3%26mau%3D0%26stl%3D32%2C13%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C20%2C17%2C20%2C17%2C19%2C20%26lb%3D100%26reqt%3D1621940320636&eri=1&cookie=ID%3D23d3f965baeb32e6%3AT%3D1621940315%3AS%3DALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw&bc=31&abxe=1&lmt=1621940320&dt=1621940320639&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=315&adys=171&adks=840336167&ucis=d&ifi=13&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=323x250&msz=323x250&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e01df2da64d977a96cc32768f0d306108cde1c573f57d81a24fb9b9666dae2fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10074
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 14 KB
8 KB 313ms
312ms XHR
text/plain 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=4284956054765355&correlator=879559508882971&output=ldjh&impl=fifs&eid=31060784%2C31061161%2C31061223%2C31061259%2C31061269%2C31061200&vrg=2021051801&ptt=17&sc=1&sfv=1-0-38&ecs=20210525&iu_parts=1254144%2Ctrovas_ch-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ris=1&rcs=3&prev_scp=a%3D%257C252%257C%26iid5%3D456778%26t%3D134%26d%3D174954%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod12-c%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dtrovas_ch-medrectangle-2-456778%26eb_br%3De29f69dd468d31a5514dc9b5587ce757%26eba%3D1%26ebss%3D10017%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D2815475924%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D16%26br2%3D450%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C168%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C819%2C899%2C917%2C918%2C919%2C20%2C17%2C18%2C19%2C20%26lb%3D160%26reqt%3D1621940320647&eri=1&cookie=ID%3D23d3f965baeb32e6%3AT%3D1621940315%3AS%3DALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw&bc=31&abxe=1&lmt=1621940320&dt=1621940320650&dlt=1621940314807&idt=153&frm=20&biw=1600&bih=1200&oid=3&adxs=436&adys=1108&adks=2530142577&ucis=e&ifi=14&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Ftrovas.ch%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1&msz=728x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=1644131464.1621940315&ga_sid=1621940315&ga_hid=1451153988&ga_fc=false&fws=512&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1708179e8b433d3e74715ffd7e485d94167965a6f2e09289bb5dad21ed1b01a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8627
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://trovas.ch
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 50ms
17ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: content-type
Origin: null
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
content-type: application/json; charset=utf-8
expires: 0
strict-transport-security: max-age=31536000
access-control-allow-origin: null
access-control-allow-headers: content-type
access-control-allow-credentials: true
access-control-allow-methods: GET
server-processing-duration-in-ticks: 1003
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
vary: Accept-Encoding

GET
H3-29 200 container.html Show response
fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7011 6 KB
3 KB 23ms
6ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://trovas.ch/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://trovas.ch/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 25 May 2021 10:58:35 GMT
expires: Wed, 25 May 2022 10:58:35 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 10ms
10ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiI5NDdmMWQ1MTY5Y2M3ZDBmOTk3NTYwZTM0ODM4ZmIwNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDQyLCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwNDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMSwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1MTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJyZWZyZXNoX2NvdW50IiwidmFsIjoiNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfYmlkX2hhc2giLCJ2YWwiOiI5NDdmMWQ1MTY5Y2M3ZDBmOTk3NTYwZTM0ODM4ZmIwNCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDQyLCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwNDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMSwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1MTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=392; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
40 B 10ms
9ms XHR
text/plain 18.156.95.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: trovas.ch
URL: https://trovas.ch/porpoiseant/banger.js?cb=194-4&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.156.95.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-95-187.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 9ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA1LTI1In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTIifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMiJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJ0X2xvY2FsX2RhdGUiLCJ2YWwiOiIyMDIxLTA1LTI1In0seyJuYW1lIjoidF9sb2NhbF9ob3VyIiwidmFsIjoiMTIifSx7Im5hbWUiOiJ0X2xvY2FsX2RheV9vZl93ZWVrIiwidmFsIjoiMiJ9LHsibmFtZSI6InRfbG9jYWxfdGltZXpvbmUiLCJ2YWwiOiItMTIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=392; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 8ms
8ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImF1Y3Rpb25fZXBvY2giOjE2MjE5NDAzMjEsImFkX3Bvc2l0aW9uIjoxMTI2LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiYmlkX2Zsb29yX2luaXRpYWwiOjM1MCwiYmlkX2Zsb29yX3ByZXYiOjEwMCwiYmlkX2Zsb29yX2ZpbGxlZCI6NDIsImF1Y3Rpb25fY291bnQiOjQsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjI1MCwibXVsdGlfYWRfdW5pdCI6MSwibXVsdGlfYWRfY291bnQiOjMsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MjE5NDAzMTQsImF1Y3Rpb25fZXBvY2giOjE2MjE5NDAzMjEsImFkX3Bvc2l0aW9uIjoxMTI2LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiYmlkX2Zsb29yX2luaXRpYWwiOjM1MCwiYmlkX2Zsb29yX3ByZXYiOjEwMCwiYmlkX2Zsb29yX2ZpbGxlZCI6NDIsImF1Y3Rpb25fY291bnQiOjQsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjI1MCwibXVsdGlfYWRfdW5pdCI6MSwibXVsdGlfYWRfY291bnQiOjMsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=392; ezouspva=2
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4817 478 B
251 B 17ms
17ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNUvxyJUTVW5cPHNOR4yyGVSJpJyPQsyq8RCiI40hTnafoBcugVtQuc1quv8Unm9lPv6J-D3lwNdVjkKpB7jwsgTqr5ACNhaUClFQlBfro7VT3humHVmi4tDsDKwhDtoJOaDw5ECiPmMIxP8y18mYkEeX7eBgiugKuz-reXXX3a01QVi0TUGq3WNbRbn2GBS1X29H1UjqVNJid-Gmbgb9Lrms6N8i2GuRC7GFhQBpccdepb-R5Q

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0414d0221112224b4c926de91a6e316f9d9aba685aa8b05fd0654848d8fcdf55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNUvxyJUTVW5cPHNOR4yyGVSJpJyPQsyq8RCiI40hTnafoBcugVtQuc1quv8Unm9lPv6J-D3lwNdVjkKpB7jwsgTqr5ACNhaUClFQlBfro7VT3humHVmi4tDsDKwhDtoJOaDw5ECiPmMIxP8y18mYkEeX7eBgiugKuz-reXXX3a01QVi0TUGq3WNbRbn2GBS1X29H1UjqVNJid-Gmbgb9Lrms6N8i2GuRC7GFhQBpccdepb-R5Q
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn4fe8rUyBRsa4J9x5YFmbr6EsxZ8MgERpaMJF3C9rx-MBPHaj7yQwP5IcZkUk
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 25 May 2021 10:58:40 GMT
server: cafe
cache-control: private
content-length: 230
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7011 24 KB
12 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CBAV486c1okFEzzmUVqZiOJiVIMKpELdnzYvY02eTKEz2OtJu0Eg-Acj-OKYlvvddDskBzZxgC473IeKAxaq9B7BbRBPJKjOBOf12OBovEtm-l0SWbLLSveKAASpFxotypf0fLlhsshcl87qDbFRiHWEUbZw&dbm_d=AKAmf-Csx4Y7D95lgWdxHSOEnfHvaJAWFIPUpmaON3dvHyfsvRYp09DFY-Bdeifct_lJPswf3ygyaSsdsQiVbHWYRDk48KsQztsCCoUd4XzhYI9wqvqh4xK0em011NqyZ5ljeSdSINNyfKtQLYLC0Cbm6eZKacIgFXaUvEimYtuGjBKnMBtplJPapMJ2kUq5hIp2QEIx-5_5B9Zuop6ZMxu-Y6oLTb-nemdo7ASijWrQUS5mV93GZzKL9vC6zrPPaomFwf96Js0T6cNQoXRkt0jzLwP4ul3fs0CgI74N6ru3JUbQ2TBOaIzlS8JuLr6Z_PkA5L41eGv-BhoV5vtuzK18YDPGmt-Z-f6sw3tbtaZFeflBjGQ5Rj7-yRdlztxwRrNfrMALDBJsNL_0XXwWr-FnsObrYSN44F_Xp0V2WwyRE3kTHBCc5kma9uA91-qTflSocS291u_5SqbIdRdoTvSIyBx5pxmOn_PbF9jxL9C3CyAWw1-pgjl8CBa5sussa6uP1rVCv-tyRgZxie2NL3M3ToZRswRQ16QjmNq2D1N-URuMMEiqSL2O95VQnZDRixDg_ssjvKKpME8Nk2Axn3FqRWm3_AKUdesAZOganGXNljDyVBqjcM6yGpRa0gLMqOFc_PR8OnQSHy2jcUlnHfUAydDgSAr_1v7RXxJSvD-wAsjvCs7_Rie2A3tF3fiDq2jk32o6rsT7dPEOdmdtzHvpbueoxHqOpCGppZS3PSK2hv5IHjk10EDxJHKIAAnjaZtQqiBHomXTraYJKvf5aND_e4lUdpNgNECJ843FRuo_GfUMr3Lnb3qCGCqRZkleMZdZsoIxNuKxZnwVfhyKjJKuaVGtQ7VBiXs34nvPBgGebo4g8T3U0KxGiFxPu_9H6GTFQWggs1Fbs-fwHE6VE5xuiFaVa3m9ED5J4W3Zc9VE28rGpdpS56JCM5LoyKPbXFMpkOgCPhoF__3_KFqVS1FomMFREG4_Ur0HeXXebqZZVMEHzO5Vc_qMmL-wLnf1fjNNT1TkDuKMa8MwKfshDSkF6Sixvaj-9bqY1eCFXfnh8GZSRCP_i2kYwn_HSAfhK1DJobeki1CgcgrBWm0Dfbtbprc0ktW7LtdJNJI0Vc5qpEJmjbwinfyhJIzMxsLL2aXThQ5xVn4mKqCZ5UWoo5pYgUHSoGvDAmjvaV0noXrcDgjbM-_-S0IEFBhMFL_JBfVCQVa0UKY21Uw72ZYuUXsIbWZcZ0eJfWxByqfZ4Vg7OitQ14_zMY7lgaosHGxvtTRlgamBGtO9MgXgqQRYgcSk8EndoOkBHH5DbCFRuaM1rv7P_ozd-kdDQ7vDzJlv-Rhb05AN1fTCiyl1_cJaOxTkdPuGi33o8R5jIGwhfogYHsga9BQ15lY38yZkShia7wzgDpH8tLBUkd7co1q0SXm6TkXpGdt6gOly9qvtBYC6Zs3vDEJbtQ6AKW0Di-18zYHaW7EQ8sL8K5hWv8pPIEur2dUkCY6YQ1VyCufeRj2EYfXomUe9-rEyUIhzl_8J2WFzDS8ZQmRWaZNfLOg_axrxK2T3EUTkv7_Vksv89zxOHQrkXv952rcymaMiGFetn9n5E4EQ3OvZf4x_F1-uzg8n9-FralHBGv8aS808zKuus12pVP9Vo97KM2Nd-w2yH-_QqtdMcCZ-an9oYgrNwI_hUK08FN30OILrFY01_ZaAzhBfIune93dWdMW9juBqJvPbiQvQ4Tf_uz4REzH9Nd1GVWyncmsKhahU8iq4KiYN8yLhP8EBjA5yDIpM0j9Bll6pckfg8d3p9NMw5G5vkpuTf5epQ6lx6aAbV8wXYy285fjeeOdUoyff3UXZDP3Qvau1uOwrRX_QtbWeZb8QYNoViQQGPOkg3mBTywIO2uOJJ5IzSkQKozbp50NDYw-2utUh--UPhblebDvgX4L6ldioefElmPrYUNiltJxr1Ke5G4SYO5HffqGSUyA8Q2ctd-ZDZVWvdiq-ZXKs1BX2WdzD58V7zPIkWZaORMlTQipPDfF2e5PmoFgwh41BrG9lCINgvMhplgz_hpq-QHYvTvqHiZDQLmI4nX38wW5ldF2lzLPoTfDFyl1vQB7rSTzwEBV0z5b7DEz0N5z3Y_cwCzFzo4xy7VYtcUyDaeZL2QiyvvCjA_Y_UsahDRr_mcq4Kg_rlcRIUYjjW1zllNaUAOFw2yPJJ-IZQQ1zRfKjw3wqS7LAlG2B3_TG-Ewyjwj4vlHcFtv60ykLn5fkhBHDjgTSt_qkYYKBPtOTOEZXQ5pBh0BcA7Fy94syiYAOkjZ7UtXXFeKPSItdJn1w4ENSxetfFoim0omgnqCPp9NYJr9ujlSlwXW_DWo1Z3ElViMgmWPRdjK_eSKFxlhqr7L7a9ozv3Xb8N9tKm4OHWY3przQ9jsNH_x6R1kpXb1-yEmhaMfBOpKZ3MQ6Vu18vI93w5nU6hEoJ2tw4iXBRhA6qq067muk0_lIBx1B54Ng0yYuJfAD-kngAIqbrTHHqLD7FDQ4eXuvb5nJ_oQYCwuI3uGO0WGZH3ZZoTnTUzrlqcurapLRhvYIsz2gGlZqV6cepFjBBe3eF0M3wncQJnXAAoIqXgAtymkXuOYhhjPc50_VVaSZsA7NMRmJW0Y0It3njuqxJdxa5ycpT2isaeVn8PCxl0Ry6z0gb-1iUrFv539GdV4PLaTnELxqf1uYuacnKJ3rozRa4snB5iXtHrNAFe4u7Nwa5-hEpt4_q78aNRT1UMA90uzMotwdk2dofYedAXuoOHXdibGvP41n5zmvnGWUsjwS1cSW0OTG2gaPIC2x_Q7BLxUnKGcQsCUs1grYyfF8w1lDOtLzP-cLQ3whedW08VAa_JDko8Uauu6grHdIKuStF-VAXFTtsgFq7fd7pB2dYA390tCzHLlj4jpYXUq_ZB7c948Bl3aOZUKLLYnwMHbG5fwecwVuhjAehPV_hvt2xf9rQlQ2pYTkPjk00YGGKBBB6A9cEiWVVrrS6-I17XhD_Prt1pFfeWwpwCxlD_6--s2ZadBjSpexixO4njn77Y8FMtdmFDpNxU4iVr7GLE94mFKlyyVTBMQ67KCfCfTg2nmia3oIDOZ5cpIG9Ei0sVKmimOl-9mf9Wc0tkhwrOQ_MF5buRxEYNw-IGK7SsdRsUkqYDDfc0KrTVQ6Z8oCIv1wxjiL-jTvr-VCm2DRA_fKozSlG7e2tgfVolejPr-2pzej9IDV1jIx0KWmrfIyCg63v8n8AFK72Ckeh1Umw8ejZOnAcmpbiDJ-MsiHa1fHmBVfWxfmeqslP0-YYNKNpPl59IA5sg4&cid=CAASEuRo1NXagXxaTOkk0Czen4YTlA&rfl=1%2Chttps%253A%252F%252Ftrovas.ch%252F%240

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0f53c4b931be224e86d4fd815dcec0502345b711e142db7689039813abdefa3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7011 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DF_Cn_Nt72n5ecgcdOwWzbV3Yi6Chh8XnHRkeW8DURTbA1HWNRqmoTZ8CgO4xd3BHzSdU1Nmkoe9vHiGZmH8R6JYDbXb87szmMNQwbMBQx-_ZsP04

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 7011 8 KB
4 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbc18bfcdb63aa599b390c356eeb1669bc3c89d83e7cbdb89bf14ac8e29a5b4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:45:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 May 2021 13:56:09 GMT
server: sffe
age: 762
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3772
x-xss-protection: 0
expires: Tue, 25 May 2021 11:45:58 GMT

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/rjss/st/695971/54149679/ Frame 7011 45 KB
13 KB 113ms
53ms Script
application/javascript 52.19.211.247
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/rjss/st/695971/54149679/skeleton.js
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.211.247 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-211-247.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 84758bbea585bb65101e9e630924460752c23b34b03e08a12001e8c2149795e5

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-server-name: app05.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame 7011 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/window_focus_fy2019.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:57:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:57:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7011 119 KB
36 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7df3462f83fb056fb3a63ae58b58146ed709812948fc954f09aede85bcc1e37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1621855623965245"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37215
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:40 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame 7011 13 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4821fcf9c6131b5e09c316f6946b187f0b3751d723a19b2ff9f2df396d232cbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 125
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5621
x-xss-protection: 0
server: cafe
etag: 8169261014141303515
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:56:35 GMT

GET
H3-29 204 l
www.google.com/ads/measurement/ Frame 7011 0
0 23ms
22ms Image
text/html 2a00:1450:4001:80f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRxypjbgKiJ24rCG47pq5Q45BfYBItr2Q6WnWE6IFo3inFMv7-BNFLsGnrD6vblaC0gTWKu1nlzD_fNfKvkaDOSd61oAA
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3-29
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-29 200 container.html Show response
fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 6CA7 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://trovas.ch/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://trovas.ch/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 25 May 2021 10:58:35 GMT
expires: Wed, 25 May 2022 10:58:35 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 10ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMjYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6Ijk0N2YxZDUxNjljYzdkMGY5OTc1NjBlMzQ4MzhmYjA0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjY5MzkiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtYm94LTItMCIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDQyLCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwNDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMSwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMjYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDQzNTQ3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjY5MzkiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtYm94LTItMCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NDcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMjYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6Ijk0N2YxZDUxNjljYzdkMGY5OTc1NjBlMzQ4MzhmYjA0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjY5MzkiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtYm94LTItMCIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDQyLCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwNDIsImJpZF9mbG9vcl9wcmV2IjowLjAwMSwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ2NjkzOSIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1ib3gtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMjYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDQzNTQ3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NjY5MzkiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtYm94LTItMCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTI2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NDcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=434; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 11ms
10ms XHR
text/plain 18.156.95.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: trovas.ch
URL: https://trovas.ch/porpoiseant/banger.js?cb=194-4&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.156.95.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-95-187.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 9ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNS0yNSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjEyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEyNiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNS0yNSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjEyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=434; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 8ms
8ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhdWN0aW9uX2Vwb2NoIjoxNjIxOTQwMzIxLCJhZF9wb3NpdGlvbiI6MTEyNiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImJpZF9mbG9vcl9pbml0aWFsIjozNTAsImJpZF9mbG9vcl9wcmV2IjoxMDAsImJpZF9mbG9vcl9maWxsZWQiOjQyLCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjoyOTIsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjozLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDY2OTM5IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhdWN0aW9uX2Vwb2NoIjoxNjIxOTQwMzIxLCJhZF9wb3NpdGlvbiI6MTEyNiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImJpZF9mbG9vcl9pbml0aWFsIjozNTAsImJpZF9mbG9vcl9wcmV2IjoxMDAsImJpZF9mbG9vcl9maWxsZWQiOjQyLCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjoyOTIsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjozLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=434; ezouspva=3
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H3-29 200 pixel
cm.g.doubleclick.net/ Frame 4817 170 B
188 B 20ms
19ms Image
image/png 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNUvxyJUTVW5cPHNOR4yyGVSJpJyPQsyq8RCiI40hTnafoBcugVtQuc1quv8Unm9lPv6J-D3lwNdVjkKpB7jwsgTqr5ACNhaUClFQlBfro7VT3humHVmi4tDsDKwhDtoJOaDw5ECiPmMIxP8y18mYkEeX7eBgiugKuz-reXXX3a01QVi0TUGq3WNbRbn2GBS1X29H1UjqVNJid-Gmbgb9Lrms6N8i2GuRC7GFhQBpccdepb-R5Q

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4817
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1

43 B
1014 B

13ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNUvxyJUTVW5cPHNOR4yyGVSJpJyPQsyq8RCiI40hTnafoBcugVtQuc1quv8Unm9lPv6J-D3lwNdVjkKpB7jwsgTqr5ACNhaUClFQlBfro7VT3humHVmi4tDsDKwhDtoJOaDw5ECiPmMIxP8y18mYkEeX7eBgiugKuz-reXXX3a01QVi0TUGq3WNbRbn2GBS1X29H1UjqVNJid-Gmbgb9Lrms6N8i2GuRC7GFhQBpccdepb-R5Q
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:40 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:40 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4817
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YKzYW8JFpNqYPxopuCbkNgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1

43 B
1014 B

31ms
31ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNUvxyJUTVW5cPHNOR4yyGVSJpJyPQsyq8RCiI40hTnafoBcugVtQuc1quv8Unm9lPv6J-D3lwNdVjkKpB7jwsgTqr5ACNhaUClFQlBfro7VT3humHVmi4tDsDKwhDtoJOaDw5ECiPmMIxP8y18mYkEeX7eBgiugKuz-reXXX3a01QVi0TUGq3WNbRbn2GBS1X29H1UjqVNJid-Gmbgb9Lrms6N8i2GuRC7GFhQBpccdepb-R5Q
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:41 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 25 May 2021 10:58:41 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFLoNuDelO5SVSnAs3Pw7EE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3943 611 B
316 B 23ms
18ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNX1hu1syAS07WCEaWsXuDV4vikH9uQw-PsMsttUgvaEVvhFf-s9lUz-1Lg0KJBxrtb43clZl-9ZxIhu3-ydCdqzwcZ584m-JeJGY5SrvHNt3C8cbQGoqn3A0PGAux-dAnEEO1d9TUO8bckfILzAfByWcWEWOpVOkzCAoHg7tsZ4LkF4IHG-dAeUuIVKSAGGK14NAn6wDzpG1PRdHKLdqTh-wcadntB_VS1rSh4fKRzVWiFC9dE

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55b198b5ed1bd02e77f84c6971a69d5c2160c0c32fd770ce33405e194750f5fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNX1hu1syAS07WCEaWsXuDV4vikH9uQw-PsMsttUgvaEVvhFf-s9lUz-1Lg0KJBxrtb43clZl-9ZxIhu3-ydCdqzwcZ584m-JeJGY5SrvHNt3C8cbQGoqn3A0PGAux-dAnEEO1d9TUO8bckfILzAfByWcWEWOpVOkzCAoHg7tsZ4LkF4IHG-dAeUuIVKSAGGK14NAn6wDzpG1PRdHKLdqTh-wcadntB_VS1rSh4fKRzVWiFC9dE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn4fe8rUyBRsa4J9x5YFmbr6EsxZ8MgERpaMJF3C9rx-MBPHaj7yQwP5IcZkUk
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 25 May 2021 10:58:40 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6CA7 23 KB
12 KB 37ms
33ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DulXUqgFUVZZoYysIN3uv_qzjiul00aVQr6pUG3YjG3cWV-CDhu0HfBF6pnJaBgzAlzTBh2m_Hnls4V4BlSRhRYdkRW_lKw70DF42FMQVXXGdd4z6XdtFja2TgQBxkNfgOpFx1KzIwMuZj5J0aa4It84zkKQ&dbm_d=AKAmf-AMv3SpMHlDiKM7VF5UlNnbmtKS1OhXe28aQEEpm3R-U0WZ3LpZEMz8BCua7ZPw4JD_iqaZViBefkydbX43ElezzIqUimMHBmCdv0MYJXrdx9p12ONZJgVv7mR_beA9RHCkaAbVqD2vXDnhEhwxhzwWjnOyqG2s7Cq_Q9RRNqhkU9D2ZD-WvNrOtuDJxezZxrrB-dzJrvZzvmj8EqVZ5UvoOEoex6H5bRRSo14IGRFZit59-rQMTPRR90MrdQ8B3FmEP-8YuZnjQcgbVNN7brWleO03N7yx6y2ZfJkwbmstSKB-PL3Bevf8WaSyECPNtsyp99BQi6XreEpro7TcZdcBs1yUSqWG4C5l8qB6M5ZFMLMjN3kPEJa3Glox5Y_akXNXtUCTFQ_XZfM45ezXwnXxH1aLIVzGaUABsqpX_LOenS-j4gj_7wspnLuTD4eNgnVKMNM4ejZCdsss3ks8mEmCLCgtkGG1Tg3xIfPmDmcSHN-O9QuW-zXOCs0FZqHap-mEoumJOPGrJT_NOyqz-gbGe6zFYKtTOHEAzGMUSYeHfCOf7MB-C50DVSK1JGc3ApmRc9IVz12AI56On_FECR2ths3_Kf1LyRPJIB0rhC5MpKe8tkp29ltXxbIAQxEKacY03J7EXrM7_N3iIi5qx3lM8NcnixdHlCPxBZw_yCJ5Ejvo2du1zlMkfgP3BphYQZ721c8RbGfLKQ929NI9MJJp0ztxej8g17YhK8f3EBwfb-fJ0PW3R6eflbWE_9emWTigK0p_N7WmNStklY2Zxrp6HkWklXxmIJ5irTldlxpkKa26GUINobIgB1Gq9MiTpYdbsZp8CQg2oDZKC8RTq6CYwv5eCORAWzMyzz_FsYXytrl0TVxhpYb7MTzBm_A03RRiLhpPJMBeWaHdiL4ZlfDug3lZbO3lla5iZLDQ3ueNTwkWFUZ0Z7ovTySCH2nsW39Z-0Azp6OPQfhUlf6fr6kBiye64BV-bxUejet6riR_hSA47Z8KvLDc3NDNxjzAbPi3HAy_flLO-ljUjweLNf04iomXHff5nzpN2OAu-jcjf1MSJNpTJKlZBlSgmI3cxA-KOdYA0UwrNOpziaDPfz5WYZRzedPfXlh57My8ILZrOWreylL82UdL9Z5HA21YoguaDLUjyIlwrPH9fznAlTgj5Uj3ll0J4LjEoL_SgUNXuAURWDRmtPlGjwk1Ze2mWKTmIUsSxFTzE3OqQflGN9NAl9SVWyCBt87dKXrDYN7nNqVA7IdLXE9r7-YwvbNBIu4iNr1PKtlewF6A2ZKN0TOEegGqd9pA29PXeuEmnN1desSDi-8vHZV1xoG-1dvIdWzrDoTvlsHB2T46udoi2KIUqidhYp6P5qS7x-6MMNc2Ut05t7uJr_gARVqHK2KjAtL1YDa9HW7Gco8ic2cilU2XhLiDznkR0Ke-dYBnUYUB5KqISlzjxcrJ8xEn9mue1e2541nCf-ACAo4mJI5qi1tamqNnS07EgpLHG1qt2fnRSHPEjyfurtH646dfgrGh52t9XqfX6xz66gRvIRdUdx1W8DObTm5QK2SWHKxCwk6AG5i0JXR-hGwelyqHhN0mzp_y2_Wybr8sawLBg5RQu-4Hdh1hAL3actSuGwWR9dc4hDFixsJa7uUwuVYn2aJsPFwWHcVJIjPH6e11fVg6N3yZJNfR6dLm1ZQYlHz6HXgQphzF9WuY2jZ00VeV3S9EET99hXgCb_JXLO2EHSu0x0QVkgzy4U_QO98Gg0KzNnka0MYANyFrPrpU5BktKJgbK-RhWPkTw8Ji0KkJmPZK73QdCdxG9mo8jdM6UQG7fi5o9hm5pJx-uGlDvL-xfojnEVIep63sP6BfKrAUxjknQimiCYDzOn8NKTD-Rg0EJIzWmL0rxLhfi7CHzUlp27zSrdPenaDCs5D4TvnYGGUEA5ytWFXZqP6UJi7JXSgFVUfQ-dtSD63AlPWauuupk5XtAxJ3k_g_2ZqU5o7kp5F6fn5slM54qyf2CuXmA1D-W8-mtNxBgpLjpJbUskChtASnqfaz4AOr7nvBlbp40uTpoCwbiKBLo-16Fgaj2T-vuxH2gEayoxuoEHNaWZEkG2dt2aadvckQlQ1YOdzKD6ORH9ChsHi7fHwW8LC7xn74nRnPbXl3h4LN-Jb7-d4Jthflk0Yfy3Th8Lseaf30G1PiNQnRQIik5poMpIg0IxSF_RylfukFx_NI_PKmMUENPT7hUWkWu07WAWkzoP4ZM1RIm_wo65YFCO4zZkgK7L7KdWqK91DOiUDEmZ4GAiyclvItemfFyCajHknVvkFJVwZFsEYre9rNqFJcuZnjcr3kd8_8AnEGJO1KgAHhZzklbIuqZbw7P9VTTNzmcJIxDiJSnDKRtYZ8VmMxchcMgJmIlN1bhrGKb2KmfPpXwq-824WTnJBqo2vu3_EedDgTwja5QUauxNrKpWc10YBFIzKOVpmFy0mQv2y-z5uod7vO0T4aO_ENVzMj66jcbl3h7CRUxKXNsFifIUOrRn8GOteNQoR9MXGLgY0CyfbPSJ8ymvUSdrc1Ztjykz7GfKEUwJoG6QXodqXmzgcIDRarEqPFPLmUCv0Ehkrdl6TN7a-sgJnEXhm35ajNN8Exia0h2xiuiwpvYNxyDCYs8Wr5yqcWzxSyiRboyQsPVU4RBKmwtRP6_pmx7y6koc6awUzG8GFblxlEQIoHrX0SdkwAVyVwjl1zKDxiikFi6pFn6jITHHaDpXX02hhJZEMWGr8ayUey4zfYZEwL6PGzGgFK78HRVHSD0eMjVg5WsAoFPRpNYADq6hwtCCzpTmhsFjwdbBFhcB5OwlDWdxpEogpCCsqClDedUBQ2E0DYZ6a7ZF4y36IeaZQRvT8vFRrnw3QI3TFMK9e9gloSmn4ssReF6iecAwl_LH7BpHhvEMabnMnA819EiL2LICPVRI6JfbBfkcK1vT-m6Tz2bY_gx3l3O_bVHW7oU9u5YWXlKVTcg582PvxWqLPZe4QQPmBsHz-rfSjFsKYdFJ6vKy69vuIsE5DlUqajSbJWZ2-gL954WYQh1xBdccmr9aQe6VTBQ_9m0mzIkH5zD2QAfm5pmH49q6SesA5TD805wNdua8QpERThCJXRPl19-DChJw5g7vmNqLSXNamQ-PVHlEni77pYvu8RgCgoEsb6CT0VJaen3MCF8h9U16fNrsVy2oDpbwCfNOBc0zEV4EM6GdrhJ7ZKC_rVHTcH5ypOpslQKNVjQyz13rywKPeHYBVzf53A7KKL2rSUZo5Gxs6aznfNXx8W7MZ3opZD4AZRpIw&cid=CAASEuRon9miH326QM5wVvZpPj9DCA&rfl=1%2Chttps%253A%252F%252Ftrovas.ch%252F%240

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d7948175e2bf7e81e9c7fa2414226adc720b035924ea54f509ff6f59769cb598

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12176
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6CA7 42 B
63 B 43ms
39ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BysAsSJHgDIYtMQIeep0gfK15S6U6fhiMeuruhs1STvFBha1zsZZSxRUErShIABvvUbqEkaI-uFW9MEurf6-1dAw-wpRkEcyYZTpVVUVkkcNN7fv8

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 6CA7 8 KB
4 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbc18bfcdb63aa599b390c356eeb1669bc3c89d83e7cbdb89bf14ac8e29a5b4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:45:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 24 May 2021 13:56:09 GMT
server: sffe
age: 762
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3772
x-xss-protection: 0
expires: Tue, 25 May 2021 11:45:58 GMT

GET
H2 200 skeleton.js Show response
pixel.adsafeprotected.com/rjss/st/695971/54149679/ Frame 6CA7 45 KB
13 KB 74ms
50ms Script
application/javascript 52.19.211.247
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/rjss/st/695971/54149679/skeleton.js
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.211.247 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-211-247.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 84c3f6b6bdb392b2ff756fda357c9712bc921db01ee9b9dd74c2c574603bad0e

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-server-name: app09.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame 6CA7 2 KB
1 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/window_focus_fy2019.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:57:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 82
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:57:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6CA7 119 KB
36 KB 17ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7df3462f83fb056fb3a63ae58b58146ed709812948fc954f09aede85bcc1e37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1621855623965245"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37215
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:40 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame 6CA7 13 KB
6 KB 8ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4821fcf9c6131b5e09c316f6946b187f0b3751d723a19b2ff9f2df396d232cbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 125
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5621
x-xss-protection: 0
server: cafe
etag: 8169261014141303515
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:56:35 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/ Frame 7011 22 KB
8 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CBAV486c1okFEzzmUVqZiOJiVIMKpELdnzYvY02eTKEz2OtJu0Eg-Acj-OKYlvvddDskBzZxgC473IeKAxaq9B7BbRBPJKjOBOf12OBovEtm-l0SWbLLSveKAASpFxotypf0fLlhsshcl87qDbFRiHWEUbZw&dbm_d=AKAmf-Csx4Y7D95lgWdxHSOEnfHvaJAWFIPUpmaON3dvHyfsvRYp09DFY-Bdeifct_lJPswf3ygyaSsdsQiVbHWYRDk48KsQztsCCoUd4XzhYI9wqvqh4xK0em011NqyZ5ljeSdSINNyfKtQLYLC0Cbm6eZKacIgFXaUvEimYtuGjBKnMBtplJPapMJ2kUq5hIp2QEIx-5_5B9Zuop6ZMxu-Y6oLTb-nemdo7ASijWrQUS5mV93GZzKL9vC6zrPPaomFwf96Js0T6cNQoXRkt0jzLwP4ul3fs0CgI74N6ru3JUbQ2TBOaIzlS8JuLr6Z_PkA5L41eGv-BhoV5vtuzK18YDPGmt-Z-f6sw3tbtaZFeflBjGQ5Rj7-yRdlztxwRrNfrMALDBJsNL_0XXwWr-FnsObrYSN44F_Xp0V2WwyRE3kTHBCc5kma9uA91-qTflSocS291u_5SqbIdRdoTvSIyBx5pxmOn_PbF9jxL9C3CyAWw1-pgjl8CBa5sussa6uP1rVCv-tyRgZxie2NL3M3ToZRswRQ16QjmNq2D1N-URuMMEiqSL2O95VQnZDRixDg_ssjvKKpME8Nk2Axn3FqRWm3_AKUdesAZOganGXNljDyVBqjcM6yGpRa0gLMqOFc_PR8OnQSHy2jcUlnHfUAydDgSAr_1v7RXxJSvD-wAsjvCs7_Rie2A3tF3fiDq2jk32o6rsT7dPEOdmdtzHvpbueoxHqOpCGppZS3PSK2hv5IHjk10EDxJHKIAAnjaZtQqiBHomXTraYJKvf5aND_e4lUdpNgNECJ843FRuo_GfUMr3Lnb3qCGCqRZkleMZdZsoIxNuKxZnwVfhyKjJKuaVGtQ7VBiXs34nvPBgGebo4g8T3U0KxGiFxPu_9H6GTFQWggs1Fbs-fwHE6VE5xuiFaVa3m9ED5J4W3Zc9VE28rGpdpS56JCM5LoyKPbXFMpkOgCPhoF__3_KFqVS1FomMFREG4_Ur0HeXXebqZZVMEHzO5Vc_qMmL-wLnf1fjNNT1TkDuKMa8MwKfshDSkF6Sixvaj-9bqY1eCFXfnh8GZSRCP_i2kYwn_HSAfhK1DJobeki1CgcgrBWm0Dfbtbprc0ktW7LtdJNJI0Vc5qpEJmjbwinfyhJIzMxsLL2aXThQ5xVn4mKqCZ5UWoo5pYgUHSoGvDAmjvaV0noXrcDgjbM-_-S0IEFBhMFL_JBfVCQVa0UKY21Uw72ZYuUXsIbWZcZ0eJfWxByqfZ4Vg7OitQ14_zMY7lgaosHGxvtTRlgamBGtO9MgXgqQRYgcSk8EndoOkBHH5DbCFRuaM1rv7P_ozd-kdDQ7vDzJlv-Rhb05AN1fTCiyl1_cJaOxTkdPuGi33o8R5jIGwhfogYHsga9BQ15lY38yZkShia7wzgDpH8tLBUkd7co1q0SXm6TkXpGdt6gOly9qvtBYC6Zs3vDEJbtQ6AKW0Di-18zYHaW7EQ8sL8K5hWv8pPIEur2dUkCY6YQ1VyCufeRj2EYfXomUe9-rEyUIhzl_8J2WFzDS8ZQmRWaZNfLOg_axrxK2T3EUTkv7_Vksv89zxOHQrkXv952rcymaMiGFetn9n5E4EQ3OvZf4x_F1-uzg8n9-FralHBGv8aS808zKuus12pVP9Vo97KM2Nd-w2yH-_QqtdMcCZ-an9oYgrNwI_hUK08FN30OILrFY01_ZaAzhBfIune93dWdMW9juBqJvPbiQvQ4Tf_uz4REzH9Nd1GVWyncmsKhahU8iq4KiYN8yLhP8EBjA5yDIpM0j9Bll6pckfg8d3p9NMw5G5vkpuTf5epQ6lx6aAbV8wXYy285fjeeOdUoyff3UXZDP3Qvau1uOwrRX_QtbWeZb8QYNoViQQGPOkg3mBTywIO2uOJJ5IzSkQKozbp50NDYw-2utUh--UPhblebDvgX4L6ldioefElmPrYUNiltJxr1Ke5G4SYO5HffqGSUyA8Q2ctd-ZDZVWvdiq-ZXKs1BX2WdzD58V7zPIkWZaORMlTQipPDfF2e5PmoFgwh41BrG9lCINgvMhplgz_hpq-QHYvTvqHiZDQLmI4nX38wW5ldF2lzLPoTfDFyl1vQB7rSTzwEBV0z5b7DEz0N5z3Y_cwCzFzo4xy7VYtcUyDaeZL2QiyvvCjA_Y_UsahDRr_mcq4Kg_rlcRIUYjjW1zllNaUAOFw2yPJJ-IZQQ1zRfKjw3wqS7LAlG2B3_TG-Ewyjwj4vlHcFtv60ykLn5fkhBHDjgTSt_qkYYKBPtOTOEZXQ5pBh0BcA7Fy94syiYAOkjZ7UtXXFeKPSItdJn1w4ENSxetfFoim0omgnqCPp9NYJr9ujlSlwXW_DWo1Z3ElViMgmWPRdjK_eSKFxlhqr7L7a9ozv3Xb8N9tKm4OHWY3przQ9jsNH_x6R1kpXb1-yEmhaMfBOpKZ3MQ6Vu18vI93w5nU6hEoJ2tw4iXBRhA6qq067muk0_lIBx1B54Ng0yYuJfAD-kngAIqbrTHHqLD7FDQ4eXuvb5nJ_oQYCwuI3uGO0WGZH3ZZoTnTUzrlqcurapLRhvYIsz2gGlZqV6cepFjBBe3eF0M3wncQJnXAAoIqXgAtymkXuOYhhjPc50_VVaSZsA7NMRmJW0Y0It3njuqxJdxa5ycpT2isaeVn8PCxl0Ry6z0gb-1iUrFv539GdV4PLaTnELxqf1uYuacnKJ3rozRa4snB5iXtHrNAFe4u7Nwa5-hEpt4_q78aNRT1UMA90uzMotwdk2dofYedAXuoOHXdibGvP41n5zmvnGWUsjwS1cSW0OTG2gaPIC2x_Q7BLxUnKGcQsCUs1grYyfF8w1lDOtLzP-cLQ3whedW08VAa_JDko8Uauu6grHdIKuStF-VAXFTtsgFq7fd7pB2dYA390tCzHLlj4jpYXUq_ZB7c948Bl3aOZUKLLYnwMHbG5fwecwVuhjAehPV_hvt2xf9rQlQ2pYTkPjk00YGGKBBB6A9cEiWVVrrS6-I17XhD_Prt1pFfeWwpwCxlD_6--s2ZadBjSpexixO4njn77Y8FMtdmFDpNxU4iVr7GLE94mFKlyyVTBMQ67KCfCfTg2nmia3oIDOZ5cpIG9Ei0sVKmimOl-9mf9Wc0tkhwrOQ_MF5buRxEYNw-IGK7SsdRsUkqYDDfc0KrTVQ6Z8oCIv1wxjiL-jTvr-VCm2DRA_fKozSlG7e2tgfVolejPr-2pzej9IDV1jIx0KWmrfIyCg63v8n8AFK72Ckeh1Umw8ejZOnAcmpbiDJ-MsiHa1fHmBVfWxfmeqslP0-YYNKNpPl59IA5sg4&cid=CAASEuRo1NXagXxaTOkk0Czen4YTlA&rfl=1%2Chttps%253A%252F%252Ftrovas.ch%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4c0938e087a40c05a99d723eaf012958e03b048659bed9b36a2bc63f766d32b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:56:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8593
x-xss-protection: 0
server: cafe
etag: 3013172215444160546
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:56:52 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7011 41 KB
15 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 05:20:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20285
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 May 2022 05:20:35 GMT

GET
H3-29 200 impl_v72.js Show response
www.googletagservices.com/dcm/ Frame 7011 37 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v72.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f630a191b479def3ee0f7408cfec54c5e6cad83fec65155d68ef83dcd381714

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 12:45:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 13 May 2021 20:34:47 GMT
server: sffe
age: 79961
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15545
x-xss-protection: 0
expires: Tue, 24 May 2022 12:45:59 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2D27 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 25 May 2021 05:20:35 GMT
expires: Wed, 25 May 2022 05:20:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 20285
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3943
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEKuwQB7X-C7EBbW9AA7bJug&google_cver=1

43 B
1 KB

13ms
13ms

Image
image/gif

185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEKuwQB7X-C7EBbW9AA7bJug&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNX1hu1syAS07WCEaWsXuDV4vikH9uQw-PsMsttUgvaEVvhFf-s9lUz-1Lg0KJBxrtb43clZl-9ZxIhu3-ydCdqzwcZ584m-JeJGY5SrvHNt3C8cbQGoqn3A0PGAux-dAnEEO1d9TUO8bckfILzAfByWcWEWOpVOkzCAoHg7tsZ4LkF4IHG-dAeUuIVKSAGGK14NAn6wDzpG1PRdHKLdqTh-wcadntB_VS1rSh4fKRzVWiFC9dE

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:41 GMT
X-Proxy-Origin: 185.220.70.226; 185.220.70.226; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.223.135:80
AN-X-Request-Uuid: e77bab49-cd00-4a3a-9629-22ef533ffc25
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEKuwQB7X-C7EBbW9AA7bJug&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3943
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzY3NzA3NzA0NzM1MTg0NjEzMg%3D%3D

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzY3NzA3NzA0NzM1MTg0NjEzMg%3D%3D

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:40 GMT
X-Proxy-Origin: 185.220.70.226; 185.220.70.226; 726.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com; 185.33.222.231:80
AN-X-Request-Uuid: 22ee940d-ccaf-4604-81ca-806b7af7bd2e
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzY3NzA3NzA0NzM1MTg0NjEzMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 3943
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOc2UxRhurfXQj0XnPxsAPA&google_cver=1

43 B
180 B

16ms
16ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOc2UxRhurfXQj0XnPxsAPA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CK0CELqMgMoCGOvd_KQBMAE&v=APEucNX1hu1syAS07WCEaWsXuDV4vikH9uQw-PsMsttUgvaEVvhFf-s9lUz-1Lg0KJBxrtb43clZl-9ZxIhu3-ydCdqzwcZ584m-JeJGY5SrvHNt3C8cbQGoqn3A0PGAux-dAnEEO1d9TUO8bckfILzAfByWcWEWOpVOkzCAoHg7tsZ4LkF4IHG-dAeUuIVKSAGGK14NAn6wDzpG1PRdHKLdqTh-wcadntB_VS1rSh4fKRzVWiFC9dE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/16.207.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
via: 1.1 google
server: OXGW/16.207.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:40 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOc2UxRhurfXQj0XnPxsAPA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3943
Redirect Chain

https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://us-u.openx.net/w/1.0/cm?cc=1&id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTQxYjU5NTAtOWE1YS0yNjc1LWQ3MjMtMGE1MTBmYzRjMjdj

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTQxYjU5NTAtOWE1YS0yNjc1LWQ3MjMtMGE1MTBmYzRjMjdj

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: gzip
server: OXGW/16.207.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=openx&google_hm=MTQxYjU5NTAtOWE1YS0yNjc1LWQ3MjMtMGE1MTBmYzRjMjdj
content-type: image/gif
alt-svc: clear
content-length: 0
via: 1.1 google

GET
H3-29 200 container.html Show response
fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 01ED 6 KB
3 KB 7ms
6ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021051801.js?31061259

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://trovas.ch/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://trovas.ch/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 3108
date: Tue, 25 May 2021 10:58:35 GMT
expires: Wed, 25 May 2022 10:58:35 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
42 B 11ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDU2Nzc4IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ1Njc3OCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImUyOWY2OWRkNDY4ZDMxYTU1MTRkYzliNTU4N2NlNzU3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NTY3NzgiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDE2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMTYsImJpZF9mbG9vcl9wcmV2IjowLjAwMTYsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NTY3NzgiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzU1MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDU2Nzc4IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDU2Nzc4IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjQifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjQ1Njc3OCIsImRvbWFpbl9pZCI6IjE3NDk1NCIsInVuaXQiOiJkaXYtZ3B0LWFkLXRyb3Zhc19jaC1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYyMTk0MDMxNCwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMGZmYjhkZjUtMmUxNC00ZDE5LTU1MzUtMmMwMGQxYWU0NmJkIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImUyOWY2OWRkNDY4ZDMxYTU1MTRkYzliNTU4N2NlNzU3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NTY3NzgiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjE5NDAzMTQsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDE2LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMTYsImJpZF9mbG9vcl9wcmV2IjowLjAwMTYsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI0NTY3NzgiLCJkb21haW5faWQiOiIxNzQ5NTQiLCJ1bml0IjoiZGl2LWdwdC1hZC10cm92YXNfY2gtbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MjE5NDAzMTQsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODMxMDA0MzU1MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDU2Nzc4IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiIyODY4NzI3NCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=450; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H2 200 28687274 Show response
g.ezoic.net/dac/ 0
17 B 10ms
9ms XHR
text/plain 18.156.95.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/28687274
Requested by: Host: trovas.ch
URL: https://trovas.ch/porpoiseant/banger.js?cb=194-4&bv=19&v=51&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.156.95.187 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-95-187.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 25 May 2021 10:58:40 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 11ms
9ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDU2Nzc4IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNS0yNSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjEyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNDU2Nzc4IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIwZmZiOGRmNS0yZTE0LTRkMTktNTUzNS0yYzAwZDFhZTQ2YmQiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wNS0yNSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjEyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjIifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTEyMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=450; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H2 200 army.gif Show response
trovas.ch/porpoiseant/ 0
19 B 10ms
8ms XHR
text/plain 3.126.196.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://trovas.ch/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDU2Nzc4IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhdWN0aW9uX2Vwb2NoIjoxNjIxOTQwMzIxLCJhZF9wb3NpdGlvbiI6MTEwMCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImJpZF9mbG9vcl9pbml0aWFsIjo5MDAsImJpZF9mbG9vcl9wcmV2IjoxNjAsImJpZF9mbG9vcl9maWxsZWQiOjE2LCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozMzksIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: trovas.ch
URL: https://trovas.ch/detroitchicago/cmb.js?gcb=194-4&cb=&01&00&03&04&0d&06&07&0a&0c&0e&11&13&17&21&23&01-100-103-1004-10d-506-507-70a-30c-30e-211-413-317-1121-123-19&cmbcb=11
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.126.196.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-126-196-163.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path: /porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNDU2Nzc4IiwiZG9tYWluX2lkIjoiMTc0OTU0IiwidW5pdCI6ImRpdi1ncHQtYWQtdHJvdmFzX2NoLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjIxOTQwMzE0LCJhdWN0aW9uX2Vwb2NoIjoxNjIxOTQwMzIxLCJhZF9wb3NpdGlvbiI6MTEwMCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjBmZmI4ZGY1LTJlMTQtNGQxOS01NTM1LTJjMDBkMWFlNDZiZCIsImJpZF9mbG9vcl9pbml0aWFsIjo5MDAsImJpZF9mbG9vcl9wcmV2IjoxNjAsImJpZF9mbG9vcl9maWxsZWQiOjE2LCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjozMzksIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
pragma: no-cache
cookie: ezouspvh=350; __gads=ID=23d3f965baeb32e6:T=1621940315:S=ALNI_Mb9tKQvSYsBL1OluX9dTVD7IxzHDw; _pbjs_userid_consent_data=3524755945110770; cto_bidid=90nUol9wSmpKZUtuSkxsYUN1Q1NpM0pWWnhBJTJCZG01VzgxS2l5UVFlcjRGSHh5bUdqTXo1QW9YSW9kQzR2cGcxZHN3UyUyRjhuRTlubmtSMkZCYVA2alBTZXdGVnclM0QlM0Q; cto_bundle=jY7uuF80RmFxYTltbk5ObzI5WG12eW9ITVMyaWI4cDBIJTJCZVhRblQyVzNyMWI2YiUyQmJaJTJGQkg0ZWdaZSUyQmd3UGhsclFnNUYyVGolMkJGYTJ6QWxpTHYlMkZGTU1hSDBKdEhmUG5VVmxkckwzJTJCVDglMkJrUWJwRmJyTWpQUkJ2YVBLOHc5T1olMkZsUWh1eg; ezouspvv=450; ezouspva=4
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: trovas.ch
referer: https://trovas.ch/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://trovas.ch/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
server: nginx/1.16.0
vary: Accept-Encoding Accept-Encoding
content-type: text/plain; charset=utf-8
x-middleton-display: ezp_sol
cache-control: max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Mon, 24 May 2021 10:58:40 UTC

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/ Frame 6CA7 22 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DulXUqgFUVZZoYysIN3uv_qzjiul00aVQr6pUG3YjG3cWV-CDhu0HfBF6pnJaBgzAlzTBh2m_Hnls4V4BlSRhRYdkRW_lKw70DF42FMQVXXGdd4z6XdtFja2TgQBxkNfgOpFx1KzIwMuZj5J0aa4It84zkKQ&dbm_d=AKAmf-AMv3SpMHlDiKM7VF5UlNnbmtKS1OhXe28aQEEpm3R-U0WZ3LpZEMz8BCua7ZPw4JD_iqaZViBefkydbX43ElezzIqUimMHBmCdv0MYJXrdx9p12ONZJgVv7mR_beA9RHCkaAbVqD2vXDnhEhwxhzwWjnOyqG2s7Cq_Q9RRNqhkU9D2ZD-WvNrOtuDJxezZxrrB-dzJrvZzvmj8EqVZ5UvoOEoex6H5bRRSo14IGRFZit59-rQMTPRR90MrdQ8B3FmEP-8YuZnjQcgbVNN7brWleO03N7yx6y2ZfJkwbmstSKB-PL3Bevf8WaSyECPNtsyp99BQi6XreEpro7TcZdcBs1yUSqWG4C5l8qB6M5ZFMLMjN3kPEJa3Glox5Y_akXNXtUCTFQ_XZfM45ezXwnXxH1aLIVzGaUABsqpX_LOenS-j4gj_7wspnLuTD4eNgnVKMNM4ejZCdsss3ks8mEmCLCgtkGG1Tg3xIfPmDmcSHN-O9QuW-zXOCs0FZqHap-mEoumJOPGrJT_NOyqz-gbGe6zFYKtTOHEAzGMUSYeHfCOf7MB-C50DVSK1JGc3ApmRc9IVz12AI56On_FECR2ths3_Kf1LyRPJIB0rhC5MpKe8tkp29ltXxbIAQxEKacY03J7EXrM7_N3iIi5qx3lM8NcnixdHlCPxBZw_yCJ5Ejvo2du1zlMkfgP3BphYQZ721c8RbGfLKQ929NI9MJJp0ztxej8g17YhK8f3EBwfb-fJ0PW3R6eflbWE_9emWTigK0p_N7WmNStklY2Zxrp6HkWklXxmIJ5irTldlxpkKa26GUINobIgB1Gq9MiTpYdbsZp8CQg2oDZKC8RTq6CYwv5eCORAWzMyzz_FsYXytrl0TVxhpYb7MTzBm_A03RRiLhpPJMBeWaHdiL4ZlfDug3lZbO3lla5iZLDQ3ueNTwkWFUZ0Z7ovTySCH2nsW39Z-0Azp6OPQfhUlf6fr6kBiye64BV-bxUejet6riR_hSA47Z8KvLDc3NDNxjzAbPi3HAy_flLO-ljUjweLNf04iomXHff5nzpN2OAu-jcjf1MSJNpTJKlZBlSgmI3cxA-KOdYA0UwrNOpziaDPfz5WYZRzedPfXlh57My8ILZrOWreylL82UdL9Z5HA21YoguaDLUjyIlwrPH9fznAlTgj5Uj3ll0J4LjEoL_SgUNXuAURWDRmtPlGjwk1Ze2mWKTmIUsSxFTzE3OqQflGN9NAl9SVWyCBt87dKXrDYN7nNqVA7IdLXE9r7-YwvbNBIu4iNr1PKtlewF6A2ZKN0TOEegGqd9pA29PXeuEmnN1desSDi-8vHZV1xoG-1dvIdWzrDoTvlsHB2T46udoi2KIUqidhYp6P5qS7x-6MMNc2Ut05t7uJr_gARVqHK2KjAtL1YDa9HW7Gco8ic2cilU2XhLiDznkR0Ke-dYBnUYUB5KqISlzjxcrJ8xEn9mue1e2541nCf-ACAo4mJI5qi1tamqNnS07EgpLHG1qt2fnRSHPEjyfurtH646dfgrGh52t9XqfX6xz66gRvIRdUdx1W8DObTm5QK2SWHKxCwk6AG5i0JXR-hGwelyqHhN0mzp_y2_Wybr8sawLBg5RQu-4Hdh1hAL3actSuGwWR9dc4hDFixsJa7uUwuVYn2aJsPFwWHcVJIjPH6e11fVg6N3yZJNfR6dLm1ZQYlHz6HXgQphzF9WuY2jZ00VeV3S9EET99hXgCb_JXLO2EHSu0x0QVkgzy4U_QO98Gg0KzNnka0MYANyFrPrpU5BktKJgbK-RhWPkTw8Ji0KkJmPZK73QdCdxG9mo8jdM6UQG7fi5o9hm5pJx-uGlDvL-xfojnEVIep63sP6BfKrAUxjknQimiCYDzOn8NKTD-Rg0EJIzWmL0rxLhfi7CHzUlp27zSrdPenaDCs5D4TvnYGGUEA5ytWFXZqP6UJi7JXSgFVUfQ-dtSD63AlPWauuupk5XtAxJ3k_g_2ZqU5o7kp5F6fn5slM54qyf2CuXmA1D-W8-mtNxBgpLjpJbUskChtASnqfaz4AOr7nvBlbp40uTpoCwbiKBLo-16Fgaj2T-vuxH2gEayoxuoEHNaWZEkG2dt2aadvckQlQ1YOdzKD6ORH9ChsHi7fHwW8LC7xn74nRnPbXl3h4LN-Jb7-d4Jthflk0Yfy3Th8Lseaf30G1PiNQnRQIik5poMpIg0IxSF_RylfukFx_NI_PKmMUENPT7hUWkWu07WAWkzoP4ZM1RIm_wo65YFCO4zZkgK7L7KdWqK91DOiUDEmZ4GAiyclvItemfFyCajHknVvkFJVwZFsEYre9rNqFJcuZnjcr3kd8_8AnEGJO1KgAHhZzklbIuqZbw7P9VTTNzmcJIxDiJSnDKRtYZ8VmMxchcMgJmIlN1bhrGKb2KmfPpXwq-824WTnJBqo2vu3_EedDgTwja5QUauxNrKpWc10YBFIzKOVpmFy0mQv2y-z5uod7vO0T4aO_ENVzMj66jcbl3h7CRUxKXNsFifIUOrRn8GOteNQoR9MXGLgY0CyfbPSJ8ymvUSdrc1Ztjykz7GfKEUwJoG6QXodqXmzgcIDRarEqPFPLmUCv0Ehkrdl6TN7a-sgJnEXhm35ajNN8Exia0h2xiuiwpvYNxyDCYs8Wr5yqcWzxSyiRboyQsPVU4RBKmwtRP6_pmx7y6koc6awUzG8GFblxlEQIoHrX0SdkwAVyVwjl1zKDxiikFi6pFn6jITHHaDpXX02hhJZEMWGr8ayUey4zfYZEwL6PGzGgFK78HRVHSD0eMjVg5WsAoFPRpNYADq6hwtCCzpTmhsFjwdbBFhcB5OwlDWdxpEogpCCsqClDedUBQ2E0DYZ6a7ZF4y36IeaZQRvT8vFRrnw3QI3TFMK9e9gloSmn4ssReF6iecAwl_LH7BpHhvEMabnMnA819EiL2LICPVRI6JfbBfkcK1vT-m6Tz2bY_gx3l3O_bVHW7oU9u5YWXlKVTcg582PvxWqLPZe4QQPmBsHz-rfSjFsKYdFJ6vKy69vuIsE5DlUqajSbJWZ2-gL954WYQh1xBdccmr9aQe6VTBQ_9m0mzIkH5zD2QAfm5pmH49q6SesA5TD805wNdua8QpERThCJXRPl19-DChJw5g7vmNqLSXNamQ-PVHlEni77pYvu8RgCgoEsb6CT0VJaen3MCF8h9U16fNrsVy2oDpbwCfNOBc0zEV4EM6GdrhJ7ZKC_rVHTcH5ypOpslQKNVjQyz13rywKPeHYBVzf53A7KKL2rSUZo5Gxs6aznfNXx8W7MZ3opZD4AZRpIw&cid=CAASEuRon9miH326QM5wVvZpPj9DCA&rfl=1%2Chttps%253A%252F%252Ftrovas.ch%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4c0938e087a40c05a99d723eaf012958e03b048659bed9b36a2bc63f766d32b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:56:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 109
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8593
x-xss-protection: 0
server: cafe
etag: 3013172215444160546
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:56:52 GMT

GET
H3-29 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6CA7 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 05:20:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20286
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 May 2022 05:20:35 GMT

GET
H2 200 B25762587.301404700;dc_ver=72.209;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=2923430905;ord=adoage;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCw5pLYNisYIyJKeTW7_UPtfi... Show response
ad.doubleclick.net/ddm/adj/N1416456.3886603PMPRECISIONDE/ Frame 7011 45 KB
20 KB 65ms
42ms Script
text/javascript 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1416456.3886603PMPRECISIONDE/B25762587.301404700;dc_ver=72.209;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=2923430905;ord=adoage;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCw5pLYNisYIyJKeTW7_UPtfiE6AL_nKS2Yoe8r6rXDfAuEAEg9PnGJWCV4pCCoAegAd6XqLYByAEJqQLlrbSuSYG0PqgDAaoEvQFP0HLFZ2y-HC67fYdIZAGRviBtoT74cJ6sonMii7XLO_AsIdKo5GBbkwwZ00wFjtFHhC5y7ZL_Xa-3BwayyhogrcuinmkdMvTgs0eVv7mv0DroBTUe9JtrrgAwAPLBN8UGIlNTmC1b5icyHKgFIvA0r24BAeJ-ikSTnN8fIMZtvEd1VVJfwGoLLJHLJX36emN1z7WL8VBR8pCDutb8TG_uxrQ4ndOo3OInSWIjcj798m1NdGpf1dDrmDOnU7fABLyJ7-7GA-AEA5AGAaAGTYAHiujXyQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTIxNzY5Mjg3NzA5NzMzODGACgOYCwHICwGADAGwE57KpgvIE-qq6gnQEwDYEwrYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRo1NXagXxaTOkk0Czen4YTlA%26sig%3DAOD64_17_j9uICzYzaF7kd49ten3kguUbg%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-AHdBZIfYBbBdCQCBVkjudu8Xcjie9e-TYULMIugQec4Z6VKWxtxVXbucfTifssMsA6VkJSFyO_pkCMG4gOwzbw-tS-yzSD9gg2zsV2w7-YfWaOnXyO4yCO7ThbVWppM6ehdiQzV1KYIH2iXxeXs20joU0YCA%26dbm_d%3DAKAmf-CkoPSB8RXnyowOf2Sq9-YDk5hCRgPTpB6WHMGsU4ZiKujWzfHi3b7V1sOxG3nUyyK5kG4H1lT52InIb70HMIUDkad75oMDsdY1RvkeKDvvgBntPJtXtazEhAGzdoab0xd3yMOyE-wjqNGji0v9yh97KzIU-sivYHCvAQeVHhG6xGc_znpLKNtEHIWOwqqYidQANwOg2AzBShYvUJtL1umYJ7HccBjRrj-Odlq21ifqt3eIm53L5u2bSfuMR8ywS_0kstjPrbVKmqgpsV95f_K0_L8dnslEWLMxpoHuXxRaAwgLTG9UdRiXmTMzBRKgVGfdeDKey3NzckFvt6u3NZaouO2VmrBlzpbqf2P4dHs40dD0aFtvoEWGE13tq2YKkRcmM5T9FHCjBQdC2a2KEtCrhQYcxjbDabypcdoN24nLaRHFmYAHkPf89iUqLPw5oiXPMX-V%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=1,https%3A%2F%2Ftrovas.ch%2F$0;xdt=1;crlt=rHxW1Afclh;osda=2;sttr=36;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v72.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

cafe /

Resource Hash

ad7a02abe8cae84b6996abef9c8151c3fd8224b42cb88089b02077ea861fea92

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19614
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 90D2 22 KB
8 KB 6ms
5ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 25 May 2021 05:20:35 GMT
expires: Wed, 25 May 2022 05:20:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 20286
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9824 441 B
248 B 17ms
17ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4YtfqRcDAB&v=APEucNUq5v8z6jVfJp15GnHbNlVf_yyaT8t9UtQFJ4hKG_KWFcRSc4-oaAaEwerKGt8YMblbAXDDq7Uov17dQAFK1ari-D0_JNfDLkLPU_Zpztj1dp03x4EJS4Y0fxA5lTVF6XjzDzxEsFkhkEBiCZmkNFfvMrkK6UxbJx7RH4QvCqrIhRTOiHlOX-k5HM0FjD-ZWwveyBr4-FqZmc3JeOfGo3MxesgknqInYUUmLoZwnIEie_SqklI

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bf051f3ee7aa85b70fbdb5a9c4dbe61dc57372814f700b1b23ecb4f7dfb9ce63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLO4XRDz7F4YtfqRcDAB&v=APEucNUq5v8z6jVfJp15GnHbNlVf_yyaT8t9UtQFJ4hKG_KWFcRSc4-oaAaEwerKGt8YMblbAXDDq7Uov17dQAFK1ari-D0_JNfDLkLPU_Zpztj1dp03x4EJS4Y0fxA5lTVF6XjzDzxEsFkhkEBiCZmkNFfvMrkK6UxbJx7RH4QvCqrIhRTOiHlOX-k5HM0FjD-ZWwveyBr4-FqZmc3JeOfGo3MxesgknqInYUUmLoZwnIEie_SqklI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUn4fe8rUyBRsa4J9x5YFmbr6EsxZ8MgERpaMJF3C9rx-MBPHaj7yQwP5IcZkUk
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 25 May 2021 10:58:41 GMT
server: cafe
cache-control: private
content-length: 227
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-29 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 01ED 62 KB
24 KB 50ms
48ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A625ELoa-dKwLEGL0ytFu1rsUojOYP16YNSWD4BAaQaRFxQESvD6N0YRjvitnFRnRpXTZWkTFwrz_Y--WWrKdMN8n7VXMW3yyihErfhnr99Ig4DGhRKtNBUOWqr3UbV_w773S8RzAW6IMji9LkvQxa9ohoiQ&dbm_d=AKAmf-C_GzOVRozNDqSOCWolejlrxOkw-quwzU2KS2_SYZjVUT1B4-OSlrtwzpQM98sIUZmnVgYgJqYWr0hSDEFV4z7Fg0HMoQqx-OwhEPswq0z5-Q9v7rz61_GS7D07Xc2D93Qt6So2gN6wbv3_khy7HcpfDnKrwNO3fDA-7VXTRxar_qf3nTiPcCBv66wgUAJlSeVkX6qFukBU6Y8O6WxUqQSdqBra8mKyOpxacq50i4GhifG1jNhmr2kqrmr2Y2s2X8SBhzQprMgLhXnO4Xs07-RcsFZhoxBunSTTMn4ty0icCgE04F4sPjmqo1yeaJnWM2bKPASba_BAr3-qbLvE_grfOXj_RPl6cfeSn5vLkZ6YpFbJ-X2gS_WxfCmJkdCus-h9pPsDersORI1nXV_qDobO7cUlbvz7Qflkz1jm0tg--IrN8sgcJquzkUT87vctD_5mJAULvMyDjHSxuI5utXIg1s1f5ggh4io6k5WNtSeQt7uAkibHiyuk7yPKScIVpM77MZKAYZtFm-4-gPScsh4-3VxeMJAEabcMafwsAGGvU3zjrABWKw4Hx7hft2FGkLR0_va76gQoiaJthlxJ-WZuGlAYmu3IncTF5nOXZWb0e5nCANOUzCPO_oQiH7MntgbjH2FZQkx8uRrNG6x80d0aC9cIG3NId17kaxPgcloGmib_XKtz7EYGXi-E1mLZzU4gHgOfI5am6HWQWHcnCH5WxqRAKwfMG36JCtueG7aHHZpK9tONCIPOUykgD2SMi44AMaA8QK-hL5QdQtn7VX3Y0mVTTF-Pgm4gYcZPOn_TSSxuWvWe9xbbis9fMWb4kkuZShb4Z2wwVtycriSXR1hX5ojeNoKJJUZVhuH7N7QfcCd4m6BuSpIzXHgMFM31IiP5P_IAJFLVDF4UdPz_NdyYRAjFQhZIjJKH8fzU0mleBgEqUPe6b3pksE9mhvt0uyQKtPDPuNzDP3Ztr0lo57_IGshL_6AKr4PwpaeXFkjDQCzvl4enIXJRym-WgI0LDltT-ISoqh1-l-LF96ZS5bwT1qpVuY2yQiV8Gx2wIQCmwOryJUAO2E6yTGsz9qoEPAOY3TMNkVq6sNDP-0QTHghKWcGPhRMZq5sook_VG0KY0TcrNW5MsMDg8UHbwuqZ9ChCWZRXOhyBFPz8xDWewe0SfWCtW67VhtqT-UMEgaS0PTgbdFY9Y7DL8rSAfGkhYUNqSTv9vEnbJGN0hkiZxdI7h9aqem4is8TojMdTyLLGwmV9RsFDdy1HGMmhitzOtuE_BX9cCmP32ZNWwxLptMP_FMbHywoh3FVG2Jnh3u0MBEFan1WLedtfCF7cDIQQ4e5Oqq25eIK2rBzfJYoYAmkuqcdGB1u7r-AUbxPWGnEkbBl5sXzvov7Chrzxag-QRXdlBoTf6-t-h4eACkhieEBjyAyUunC8SjogmTR4E7PTC9So_xVBDb4Y2aPYokjJG3TjdI8TOd6IxlbtZxBLWOYKWv8mc9I-fajvDuN4yUC-NF9FanPx56tFS_BtUHjiYc5rHKSQiD4fkE2CVvPSgLGvhmTkdirkgw3armzhCkUBqYTtT2ePyjxqKDNUvYNXW4rao-3CCm88Na0cLS8UTvIBLlNWzOaw54SjSPU8nkXyYbVz-P1ubClWswkq3yqOIWl52FJhyVGsB1WkHY2aTbDnSiAkJdWZSaC0V47WCSoQJPBV8c9t2Gh32q8r9mKEiwKPrVgA-Zii-YgAx7xGKMLsUsQWB8Onu3tVvkJDfTTmd7qVWhNE-e1oXhz1XxhQB8KRBGk_34KtYNHlxBrkcEeTNVoxXn_9iuMXgogiRm23ZjYqUGqECiF3btwvQF8-JO1YSM9jLJ6YxtXS3A_CCbUgasd3CvnO-PoD17NSuWMB_YZN7xUrU4593yRhRxcHwsiFPggL5hP4qyv1scRK_VYzQwRX_4-yiBT66dZJYFFmjF04ierJerwvMjFl4gezoxRQcpGqYwvrqMrQudVtEQoFcuc9UZWbxgnR2G6sq6IxJl9VZOXUFWeScxeEOm4c7pYmDu2B1lWDXzuM0sYbtoFAsJnwqXN_ivXFE_N52etnQbgou5NMCdVHLMPrFthLSQ5vAIpWyLh1nikfP-zftqpMYnThmXPMeHvbY1Kpklfunjzw4oZ70tcyNvyraEgVhY6YnayGtWn6hl6gdqX5kENkrO-ee23yNRvDVTKDOXQEn_wICjHqPn-kVElzyZuD-Tnuq7cxhZNK_5EcUEbBJDjAWCXGliAyjEcQjXL9OJUhkFbtHb14FAiTPsjmYzp3QHUWR1MQf4GckLVY5d2ybhSm2fLD5LMAbgMRXeu_28pYKlpr8bSeBUdxYKHwH9LapJke5Yqwd4wFil2LCBm-3zSnCPVCy85nQKpx2Nf9o8jLVZFrXGihsPhcl9jbl7nPuXNjoTDbn5NQsQcG-J5PdSRK7CXCWBz10pCwNaJ1PANcG5E9T_nKlGxGTvtXEw9PDYaiVOktxx7mFDvRaHlBaqqE6l8qcIkgJj1JS_UqRvXUrTP9ScObDzv8-Aa7Mww8FFaopJVG8br_y1JPAXt8kIah3BZZUNw7X4TFNVwzIK97WjWJ9naa9u4qirqMjhvzfE5U7-7e_H5NZSmaNHfQnAOlUC9Jr2lhARh-7hLqx2udc0KkbQNVle2aLL4p1fuS1KtQZSd1mKwdACdkUPvmC1Jx6b6aXtarT6QnPmBXrGQiNyVKVQ2Qubs-XwdbcHMTpxtTjbNcyAsEMxk_DrnW_e5WFFuLBLfYpFGdENDG6DKhgMlwxI8u7_aCmSe1iJ9RG1eimfrn0wq3LloqAWIB-bURYPCxhVrcdKS1Hw0hsO6z6eomvs8yvXknbTKS4KaLPXNsE4S324Ydrl-dzW_KrCDnw_-IpfrlBxcE35Bji437MV60h-sdiJHLSHb57tTy0bNAHh4alFFvr1724nL8U5WY4ygj1Iyam8lHCR9HKzRBvup7-liemR9B1VTCdz2HFvFTRSi228YeamYar5vBLkqGb5V3yp4UAk8lJkPlOmPU45GI5gaThOfwjhSNl-Ohfbq9MGsueg2a54OZHDQh69eJ1NIftMmEQrSUf80qC-oZ62bBf0qJ-wyBDIjqKlW_otM9JbIAF2ABF401WpFEA38h4iaMzTeH7l3MIOA8kFkXD9p_-_CJtsXBRWAmuVB7RC0tv-ll&cid=CAASEuRobV9QNStN1M0uawdCNgVXoQ&rfl=1%2Chttps%253A%252F%252Ftrovas.ch%252F%240

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

336fc7c4b1ad48331f523802a074e793469e9a588b25238e4630bfa6a8bb2d5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24705
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 01ED 42 B
63 B 40ms
38ms Image
image/gif 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ABqusTfRkhx9nNIXGBvo_8vcBXrqKZg1BQ6NVkZHVhMkcmsxXvp0cevjPlpT4Mz5CGdMZC9cRP6DBgnlzUBDUQq8n0_1Q8o2mtbkBt-dp3iXwMr2k

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame 01ED 2 KB
1 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/window_focus_fy2019.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:57:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:57:18 GMT

GET
H3-29 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 01ED 119 KB
36 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7df3462f83fb056fb3a63ae58b58146ed709812948fc954f09aede85bcc1e37

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1621855623965245"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37215
x-xss-protection: 0
expires: Tue, 25 May 2021 10:58:41 GMT

GET
H3-29 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/ Frame 01ED 13 KB
6 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210517/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4821fcf9c6131b5e09c316f6946b187f0b3751d723a19b2ff9f2df396d232cbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:56:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 126
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5621
x-xss-protection: 0
server: cafe
etag: 8169261014141303515
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:56:35 GMT

GET
H3-29 200 impl_v72.js Show response
www.googletagservices.com/dcm/ Frame 6CA7 37 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v72.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f630a191b479def3ee0f7408cfec54c5e6cad83fec65155d68ef83dcd381714

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 12:45:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 13 May 2021 20:34:47 GMT
server: sffe
age: 79962
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15545
x-xss-protection: 0
expires: Tue, 24 May 2022 12:45:59 GMT

GET
H3-29 200 CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js Show response
pagead2.googlesyndication.com/bg/ Frame 2D27 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096abd9dd93ed6879a4454b0e7e80392462e97bbeeff715de8ea45a0577470d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 19:06:10 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 09:08:00 GMT
server: sffe
age: 57151
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5728
x-xss-protection: 0
expires: Tue, 24 May 2022 19:06:10 GMT

GET
H3-29 200 CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js Show response
pagead2.googlesyndication.com/bg/ Frame 90D2 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CWq9ndk-1oeaRFSw5-gDkkYul7vu_3Fd6OpFoFd0cNM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096abd9dd93ed6879a4454b0e7e80392462e97bbeeff715de8ea45a0577470d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 19:06:10 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 09:08:00 GMT
server: sffe
age: 57151
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5728
x-xss-protection: 0
expires: Tue, 24 May 2022 19:06:10 GMT

GET
H2 200 B25762587.301404700;dc_ver=72.209;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=250412562;ord=iaa0yk;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCVVaVYNisYLmuKYq17_UPvKuq... Show response
ad.doubleclick.net/ddm/adj/N1416456.3886603PMPRECISIONDE/ Frame 6CA7 44 KB
19 KB 39ms
38ms Script
text/javascript 172.217.16.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1416456.3886603PMPRECISIONDE/B25762587.301404700;dc_ver=72.209;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=250412562;ord=iaa0yk;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCVVaVYNisYLmuKYq17_UPvKuqkAP_nKS2Yoe8r6rXDfAuEAEg9PnGJWCV4pCCoAegAd6XqLYByAEJqQLlrbSuSYG0PqgDAaoEvQFP0NxekG1jP4s-by7H7ry01AF_XuCBsOzQqaZG7GidBhEZBOykC9LL6XmCjmh184jYybPkaEsZ4y6Ydlthr4ZYhgZEuUhjfujh3Fq3dL6-ge_OYKwq6-MluqBG9KuzMbaoVlg2Lj64JBeyFrEjzsjFA6v4RdJVGJEQxgPSxSjiYkKHNDud-MwpMBQJDO1lDf7coO1zHunniQj_w2oM_XzpAxHCfkSnqM1ZXK1bpWdtLfpGW9k2Vg_DUNHl7_rABLyJ7-7GA-AEA5AGAaAGTYAHiujXyQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTIxNzY5Mjg3NzA5NzMzODGACgOYCwHICwGADAGwE57KpgvIE-qq6gnQEwDYEwrYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRon9miH326QM5wVvZpPj9DCA%26sig%3DAOD64_2ieTNLV3XYczxLs72KPXayLHe-Ug%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-Bl36WeJJKmKjVdJrXyiL6RweCdKJuCapwoSa-FxRZuC_aRyHiKlNkq_ZJi7Og7U0BzfzNrIBVgGIqtduHxSa5NMqgZPsku6glZz4AAZ5aYpH-Padpyk33keTS9_YXiytFFKbtz2qPIESRldWHllOnP3PmNAw%26dbm_d%3DAKAmf-Cj4w1nmWV267dLY3jZjMAeIgNfEjr1ccg1kjcfc-H7jANC2WJSa0inYciUpdmDxFKnKZGXEn9NetFcQAY6cjozYlrJtdTHmRt-BaJhmlRfQWHbnvNuWKtqmIRYzAb4nOiLVlFqEzI15GLXUIjSZz2ndWjZSEAILE50zcKN2BQ9J6AoF6saIo4N0w21poTdv8fgLGmq8iCakuxhZSNcBtvibsgZWZNa1z_T5MhLo2Aaa5qy0F2MWXeKYQoQT_EG9zpggblxjMb6L43wylgnEGBHDcrv8BpIhBwtycO7fg9axCCg2aEAz6omqFZ3YxWQB4zVJ--VC4-Z34Wtdy9naSm3YTfLYcxziwzHnZMT_BR_CW1GCJKeHQwlLxXxZW-S3FwEGHPI5LMvGHczRth9VhVvNf-VGXALfEHijUNG8MFYxr5CCJAKnAOgiu-jNlv5V6n1hlwg%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=1,https%3A%2F%2Ftrovas.ch%2F$0;xdt=1;crlt=rHxW1Afclh;osda=2;sttr=20;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v72.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f6.1e100.net

Software

cafe /

Resource Hash

237dd4f29778e4d51dfbbd9c336ac5efa4b7d5a96d8cf7e12f9a281c79d3e03c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19413
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 7011 111 KB
38 KB 19ms
6ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 14:58:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71990
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 14:58:51 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/elements/html/ Frame 7011 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1416456.3886603PMPRECISIONDE/B25762587.301404700;dc_ver=72.209;dc_eid=40004001;sz=300x250;u_sd=1;dc_adk=2923430905;ord=adoage;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCw5pLYNisYIyJKeTW7_UPtfiE6AL_nKS2Yoe8r6rXDfAuEAEg9PnGJWCV4pCCoAegAd6XqLYByAEJqQLlrbSuSYG0PqgDAaoEvQFP0HLFZ2y-HC67fYdIZAGRviBtoT74cJ6sonMii7XLO_AsIdKo5GBbkwwZ00wFjtFHhC5y7ZL_Xa-3BwayyhogrcuinmkdMvTgs0eVv7mv0DroBTUe9JtrrgAwAPLBN8UGIlNTmC1b5icyHKgFIvA0r24BAeJ-ikSTnN8fIMZtvEd1VVJfwGoLLJHLJX36emN1z7WL8VBR8pCDutb8TG_uxrQ4ndOo3OInSWIjcj798m1NdGpf1dDrmDOnU7fABLyJ7-7GA-AEA5AGAaAGTYAHiujXyQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTIxNzY5Mjg3NzA5NzMzODGACgOYCwHICwGADAGwE57KpgvIE-qq6gnQEwDYEwrYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRo1NXagXxaTOkk0Czen4YTlA%26sig%3DAOD64_17_j9uICzYzaF7kd49ten3kguUbg%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-AHdBZIfYBbBdCQCBVkjudu8Xcjie9e-TYULMIugQec4Z6VKWxtxVXbucfTifssMsA6VkJSFyO_pkCMG4gOwzbw-tS-yzSD9gg2zsV2w7-YfWaOnXyO4yCO7ThbVWppM6ehdiQzV1KYIH2iXxeXs20joU0YCA%26dbm_d%3DAKAmf-CkoPSB8RXnyowOf2Sq9-YDk5hCRgPTpB6WHMGsU4ZiKujWzfHi3b7V1sOxG3nUyyK5kG4H1lT52InIb70HMIUDkad75oMDsdY1RvkeKDvvgBntPJtXtazEhAGzdoab0xd3yMOyE-wjqNGji0v9yh97KzIU-sivYHCvAQeVHhG6xGc_znpLKNtEHIWOwqqYidQANwOg2AzBShYvUJtL1umYJ7HccBjRrj-Odlq21ifqt3eIm53L5u2bSfuMR8ywS_0kstjPrbVKmqgpsV95f_K0_L8dnslEWLMxpoHuXxRaAwgLTG9UdRiXmTMzBRKgVGfdeDKey3NzckFvt6u3NZaouO2VmrBlzpbqf2P4dHs40dD0aFtvoEWGE13tq2YKkRcmM5T9FHCjBQdC2a2KEtCrhQYcxjbDabypcdoN24nLaRHFmYAHkPf89iUqLPw5oiXPMX-V%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=1,https%3A%2F%2Ftrovas.ch%2F$0;xdt=1;crlt=rHxW1Afclh;osda=2;sttr=36;prcl=s

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:58:14 GMT

GET
H2 200 main.gr.19.8.201.js Show response
static.adsafeprotected.com/ Frame 7011 182 KB
58 KB 111ms
51ms Script
application/javascript 52.213.246.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.201.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/rjss/st/695971/54149679/skeleton.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.246.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-246-12.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 2394a068f6af11108e3bb63863e7b222c2540fecd0f25e6ec0a69433c32c0ad9

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: gzip
last-modified: Tue, 18 May 2021 19:58:40 GMT
server: nginx/1.16.1
age: 8
etag: W/"c1b29b677b41f1652ad8447e08d02f45"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B62C 1 KB
749 B 8ms
8ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 25 May 2021 06:38:34 GMT
expires: Wed, 26 May 2021 06:38:34 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 15607
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 7011 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 54a4df3273246cd9a9b4081957c3d6624770f00113c5c6d62399e0aedf1ffe6a

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

um
sync.teads.tv/ Frame 9824
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEBdnPnRHHSgImwAsakAg010&google_cver=1

23 B
172 B

42ms
41ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEBdnPnRHHSgImwAsakAg010&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4YtfqRcDAB&v=APEucNUq5v8z6jVfJp15GnHbNlVf_yyaT8t9UtQFJ4hKG_KWFcRSc4-oaAaEwerKGt8YMblbAXDDq7Uov17dQAFK1ari-D0_JNfDLkLPU_Zpztj1dp03x4EJS4Y0fxA5lTVF6XjzDzxEsFkhkEBiCZmkNFfvMrkK6UxbJx7RH4QvCqrIhRTOiHlOX-k5HM0FjD-ZWwveyBr4-FqZmc3JeOfGo3MxesgknqInYUUmLoZwnIEie_SqklI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.3 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 25 May 2021 10:58:41 GMT
server: akka-http/10.2.3
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEBdnPnRHHSgImwAsakAg010&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 9824
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=OGU0N2U5MmU3ZmUyNDc2MWJhMWQ4YmZiNGM4MjNjNWIxY2E2OTk4Ng==
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=OGU0N2U5MmU3ZmUyNDc2MWJhMWQ4YmZiNGM4MjNjNWIxY2E2OTk4Ng==&google_tc=

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=OGU0N2U5MmU3ZmUyNDc2MWJhMWQ4YmZiNGM4MjNjNWIxY2E2OTk4Ng==&google_tc=

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4YtfqRcDAB&v=APEucNUq5v8z6jVfJp15GnHbNlVf_yyaT8t9UtQFJ4hKG_KWFcRSc4-oaAaEwerKGt8YMblbAXDDq7Uov17dQAFK1ari-D0_JNfDLkLPU_Zpztj1dp03x4EJS4Y0fxA5lTVF6XjzDzxEsFkhkEBiCZmkNFfvMrkK6UxbJx7RH4QvCqrIhRTOiHlOX-k5HM0FjD-ZWwveyBr4-FqZmc3JeOfGo3MxesgknqInYUUmLoZwnIEie_SqklI

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=OGU0N2U5MmU3ZmUyNDc2MWJhMWQ4YmZiNGM4MjNjNWIxY2E2OTk4Ng==&google_tc=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 340
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sync
partners.tremorhub.com/ Frame 9824
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=tremor_video_dbm&google_cm&google_dbm
https://partners.tremorhub.com/sync?UIGL=CAESENvh4N8k9MvrxE1r7DXy82s&google_cver=1

43 B
183 B

283ms
93ms

Image
image/gif

2600:1f18:612b:4232:380b:6483:6fb1:583d
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIGL=CAESENvh4N8k9MvrxE1r7DXy82s&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLO4XRDz7F4YtfqRcDAB&v=APEucNUq5v8z6jVfJp15GnHbNlVf_yyaT8t9UtQFJ4hKG_KWFcRSc4-oaAaEwerKGt8YMblbAXDDq7Uov17dQAFK1ari-D0_JNfDLkLPU_Zpztj1dp03x4EJS4Y0fxA5lTVF6XjzDzxEsFkhkEBiCZmkNFfvMrkK6UxbJx7RH4QvCqrIhRTOiHlOX-k5HM0FjD-ZWwveyBr4-FqZmc3JeOfGo3MxesgknqInYUUmLoZwnIEie_SqklI
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4232:380b:6483:6fb1:583d Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://partners.tremorhub.com/sync?UIGL=CAESENvh4N8k9MvrxE1r7DXy82s&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 283
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 01ED 176 KB
61 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2f126a8957c32db99e94d1bf7c9ed09fcd38ba99bd632ebd048f01f9c5f9c9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 08:50:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 7663
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62241
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:47 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 08:50:58 GMT

GET
H3-29 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/elements/html/ Frame 01ED 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A625ELoa-dKwLEGL0ytFu1rsUojOYP16YNSWD4BAaQaRFxQESvD6N0YRjvitnFRnRpXTZWkTFwrz_Y--WWrKdMN8n7VXMW3yyihErfhnr99Ig4DGhRKtNBUOWqr3UbV_w773S8RzAW6IMji9LkvQxa9ohoiQ&dbm_d=AKAmf-C_GzOVRozNDqSOCWolejlrxOkw-quwzU2KS2_SYZjVUT1B4-OSlrtwzpQM98sIUZmnVgYgJqYWr0hSDEFV4z7Fg0HMoQqx-OwhEPswq0z5-Q9v7rz61_GS7D07Xc2D93Qt6So2gN6wbv3_khy7HcpfDnKrwNO3fDA-7VXTRxar_qf3nTiPcCBv66wgUAJlSeVkX6qFukBU6Y8O6WxUqQSdqBra8mKyOpxacq50i4GhifG1jNhmr2kqrmr2Y2s2X8SBhzQprMgLhXnO4Xs07-RcsFZhoxBunSTTMn4ty0icCgE04F4sPjmqo1yeaJnWM2bKPASba_BAr3-qbLvE_grfOXj_RPl6cfeSn5vLkZ6YpFbJ-X2gS_WxfCmJkdCus-h9pPsDersORI1nXV_qDobO7cUlbvz7Qflkz1jm0tg--IrN8sgcJquzkUT87vctD_5mJAULvMyDjHSxuI5utXIg1s1f5ggh4io6k5WNtSeQt7uAkibHiyuk7yPKScIVpM77MZKAYZtFm-4-gPScsh4-3VxeMJAEabcMafwsAGGvU3zjrABWKw4Hx7hft2FGkLR0_va76gQoiaJthlxJ-WZuGlAYmu3IncTF5nOXZWb0e5nCANOUzCPO_oQiH7MntgbjH2FZQkx8uRrNG6x80d0aC9cIG3NId17kaxPgcloGmib_XKtz7EYGXi-E1mLZzU4gHgOfI5am6HWQWHcnCH5WxqRAKwfMG36JCtueG7aHHZpK9tONCIPOUykgD2SMi44AMaA8QK-hL5QdQtn7VX3Y0mVTTF-Pgm4gYcZPOn_TSSxuWvWe9xbbis9fMWb4kkuZShb4Z2wwVtycriSXR1hX5ojeNoKJJUZVhuH7N7QfcCd4m6BuSpIzXHgMFM31IiP5P_IAJFLVDF4UdPz_NdyYRAjFQhZIjJKH8fzU0mleBgEqUPe6b3pksE9mhvt0uyQKtPDPuNzDP3Ztr0lo57_IGshL_6AKr4PwpaeXFkjDQCzvl4enIXJRym-WgI0LDltT-ISoqh1-l-LF96ZS5bwT1qpVuY2yQiV8Gx2wIQCmwOryJUAO2E6yTGsz9qoEPAOY3TMNkVq6sNDP-0QTHghKWcGPhRMZq5sook_VG0KY0TcrNW5MsMDg8UHbwuqZ9ChCWZRXOhyBFPz8xDWewe0SfWCtW67VhtqT-UMEgaS0PTgbdFY9Y7DL8rSAfGkhYUNqSTv9vEnbJGN0hkiZxdI7h9aqem4is8TojMdTyLLGwmV9RsFDdy1HGMmhitzOtuE_BX9cCmP32ZNWwxLptMP_FMbHywoh3FVG2Jnh3u0MBEFan1WLedtfCF7cDIQQ4e5Oqq25eIK2rBzfJYoYAmkuqcdGB1u7r-AUbxPWGnEkbBl5sXzvov7Chrzxag-QRXdlBoTf6-t-h4eACkhieEBjyAyUunC8SjogmTR4E7PTC9So_xVBDb4Y2aPYokjJG3TjdI8TOd6IxlbtZxBLWOYKWv8mc9I-fajvDuN4yUC-NF9FanPx56tFS_BtUHjiYc5rHKSQiD4fkE2CVvPSgLGvhmTkdirkgw3armzhCkUBqYTtT2ePyjxqKDNUvYNXW4rao-3CCm88Na0cLS8UTvIBLlNWzOaw54SjSPU8nkXyYbVz-P1ubClWswkq3yqOIWl52FJhyVGsB1WkHY2aTbDnSiAkJdWZSaC0V47WCSoQJPBV8c9t2Gh32q8r9mKEiwKPrVgA-Zii-YgAx7xGKMLsUsQWB8Onu3tVvkJDfTTmd7qVWhNE-e1oXhz1XxhQB8KRBGk_34KtYNHlxBrkcEeTNVoxXn_9iuMXgogiRm23ZjYqUGqECiF3btwvQF8-JO1YSM9jLJ6YxtXS3A_CCbUgasd3CvnO-PoD17NSuWMB_YZN7xUrU4593yRhRxcHwsiFPggL5hP4qyv1scRK_VYzQwRX_4-yiBT66dZJYFFmjF04ierJerwvMjFl4gezoxRQcpGqYwvrqMrQudVtEQoFcuc9UZWbxgnR2G6sq6IxJl9VZOXUFWeScxeEOm4c7pYmDu2B1lWDXzuM0sYbtoFAsJnwqXN_ivXFE_N52etnQbgou5NMCdVHLMPrFthLSQ5vAIpWyLh1nikfP-zftqpMYnThmXPMeHvbY1Kpklfunjzw4oZ70tcyNvyraEgVhY6YnayGtWn6hl6gdqX5kENkrO-ee23yNRvDVTKDOXQEn_wICjHqPn-kVElzyZuD-Tnuq7cxhZNK_5EcUEbBJDjAWCXGliAyjEcQjXL9OJUhkFbtHb14FAiTPsjmYzp3QHUWR1MQf4GckLVY5d2ybhSm2fLD5LMAbgMRXeu_28pYKlpr8bSeBUdxYKHwH9LapJke5Yqwd4wFil2LCBm-3zSnCPVCy85nQKpx2Nf9o8jLVZFrXGihsPhcl9jbl7nPuXNjoTDbn5NQsQcG-J5PdSRK7CXCWBz10pCwNaJ1PANcG5E9T_nKlGxGTvtXEw9PDYaiVOktxx7mFDvRaHlBaqqE6l8qcIkgJj1JS_UqRvXUrTP9ScObDzv8-Aa7Mww8FFaopJVG8br_y1JPAXt8kIah3BZZUNw7X4TFNVwzIK97WjWJ9naa9u4qirqMjhvzfE5U7-7e_H5NZSmaNHfQnAOlUC9Jr2lhARh-7hLqx2udc0KkbQNVle2aLL4p1fuS1KtQZSd1mKwdACdkUPvmC1Jx6b6aXtarT6QnPmBXrGQiNyVKVQ2Qubs-XwdbcHMTpxtTjbNcyAsEMxk_DrnW_e5WFFuLBLfYpFGdENDG6DKhgMlwxI8u7_aCmSe1iJ9RG1eimfrn0wq3LloqAWIB-bURYPCxhVrcdKS1Hw0hsO6z6eomvs8yvXknbTKS4KaLPXNsE4S324Ydrl-dzW_KrCDnw_-IpfrlBxcE35Bji437MV60h-sdiJHLSHb57tTy0bNAHh4alFFvr1724nL8U5WY4ygj1Iyam8lHCR9HKzRBvup7-liemR9B1VTCdz2HFvFTRSi228YeamYar5vBLkqGb5V3yp4UAk8lJkPlOmPU45GI5gaThOfwjhSNl-Ohfbq9MGsueg2a54OZHDQh69eJ1NIftMmEQrSUf80qC-oZ62bBf0qJ-wyBDIjqKlW_otM9JbIAF2ABF401WpFEA38h4iaMzTeH7l3MIOA8kFkXD9p_-_CJtsXBRWAmuVB7RC0tv-ll&cid=CAASEuRobV9QNStN1M0uawdCNgVXoQ&rfl=1%2Chttps%253A%252F%252Ftrovas.ch%252F%240

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:58:14 GMT

GET
H3-29 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/ Frame 01ED 22 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/abg_lite.js

Requested by

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4c0938e087a40c05a99d723eaf012958e03b048659bed9b36a2bc63f766d32b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:56:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 109
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8593
x-xss-protection: 0
server: cafe
etag: 3013172215444160546
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:56:52 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CACC 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 25 May 2021 05:20:35 GMT
expires: Wed, 25 May 2022 05:20:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 20286
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 6CA7 111 KB
38 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 14:58:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71990
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 14:58:51 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/elements/html/ Frame 6CA7 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210517/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1416456.3886603PMPRECISIONDE/B25762587.301404700;dc_ver=72.209;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=250412562;ord=iaa0yk;click=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCVVaVYNisYLmuKYq17_UPvKuqkAP_nKS2Yoe8r6rXDfAuEAEg9PnGJWCV4pCCoAegAd6XqLYByAEJqQLlrbSuSYG0PqgDAaoEvQFP0NxekG1jP4s-by7H7ry01AF_XuCBsOzQqaZG7GidBhEZBOykC9LL6XmCjmh184jYybPkaEsZ4y6Ydlthr4ZYhgZEuUhjfujh3Fq3dL6-ge_OYKwq6-MluqBG9KuzMbaoVlg2Lj64JBeyFrEjzsjFA6v4RdJVGJEQxgPSxSjiYkKHNDud-MwpMBQJDO1lDf7coO1zHunniQj_w2oM_XzpAxHCfkSnqM1ZXK1bpWdtLfpGW9k2Vg_DUNHl7_rABLyJ7-7GA-AEA5AGAaAGTYAHiujXyQKoB4qcsQKoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTIxNzY5Mjg3NzA5NzMzODGACgOYCwHICwGADAGwE57KpgvIE-qq6gnQEwDYEwrYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRon9miH326QM5wVvZpPj9DCA%26sig%3DAOD64_2ieTNLV3XYczxLs72KPXayLHe-Ug%26client%3Dca-pub-6396844742497208%26dbm_c%3DAKAmf-Bl36WeJJKmKjVdJrXyiL6RweCdKJuCapwoSa-FxRZuC_aRyHiKlNkq_ZJi7Og7U0BzfzNrIBVgGIqtduHxSa5NMqgZPsku6glZz4AAZ5aYpH-Padpyk33keTS9_YXiytFFKbtz2qPIESRldWHllOnP3PmNAw%26dbm_d%3DAKAmf-Cj4w1nmWV267dLY3jZjMAeIgNfEjr1ccg1kjcfc-H7jANC2WJSa0inYciUpdmDxFKnKZGXEn9NetFcQAY6cjozYlrJtdTHmRt-BaJhmlRfQWHbnvNuWKtqmIRYzAb4nOiLVlFqEzI15GLXUIjSZz2ndWjZSEAILE50zcKN2BQ9J6AoF6saIo4N0w21poTdv8fgLGmq8iCakuxhZSNcBtvibsgZWZNa1z_T5MhLo2Aaa5qy0F2MWXeKYQoQT_EG9zpggblxjMb6L43wylgnEGBHDcrv8BpIhBwtycO7fg9axCCg2aEAz6omqFZ3YxWQB4zVJ--VC4-Z34Wtdy9naSm3YTfLYcxziwzHnZMT_BR_CW1GCJKeHQwlLxXxZW-S3FwEGHPI5LMvGHczRth9VhVvNf-VGXALfEHijUNG8MFYxr5CCJAKnAOgiu-jNlv5V6n1hlwg%26adurl%3D;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%5D;dc_rfl=1,https%3A%2F%2Ftrovas.ch%2F$0;xdt=1;crlt=rHxW1Afclh;osda=2;sttr=20;prcl=s

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 27
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 08 Jun 2021 10:58:14 GMT

GET
H2 200 main.gr.19.8.201.js Show response
static.adsafeprotected.com/ Frame 6CA7 182 KB
58 KB 63ms
63ms Script
application/javascript 52.213.246.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.201.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/rjss/st/695971/54149679/skeleton.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.246.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-246-12.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 2394a068f6af11108e3bb63863e7b222c2540fecd0f25e6ec0a69433c32c0ad9

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: gzip
last-modified: Tue, 18 May 2021 19:58:40 GMT
server: nginx/1.16.1
etag: W/"c1b29b677b41f1652ad8447e08d02f45"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000

GET
H3-29 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 3C30 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 25 May 2021 06:38:34 GMT
expires: Wed, 26 May 2021 06:38:34 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 15607
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 6CA7 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7182bd80b9f5f232eefc07d67a5136a112f9c00bc99b278ab3956d597c4f1f9c

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 9A70 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 25 May 2021 05:20:35 GMT
expires: Wed, 25 May 2022 05:20:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 20286
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK tag.tr
red.vtracy.de/ Frame 7011 16 KB
17 KB 35ms
11ms Script
text/javascript 52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://red.vtracy.de/tag.tr?tr_adid=k25762587_s6701753_p301404700_c149509254&tr_mid=0&tr_sync=true&tr_uid1=DC&gdpr_consent=&gdpr=&t=2407762559
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: Apache
Connection: keep-alive
Content-Length: 16726
Content-Type: text/javascript;charset=UTF-8

GET
H3-29 200 index.html
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 9 KB
2 KB 6ms
6ms Document
text/html 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2000
date: Mon, 24 May 2021 18:28:17 GMT
expires: Tue, 25 May 2021 18:28:17 GMT
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 59424
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7011 0
60 B 75ms
74ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvJgBtYup6tAQDieGcHDF3zGi78xifHwciolgy5FGRze42Cte_9W4pJiIFm2cTEjGqOyb7Fp_Ez1neJSeTUR_UEF7eTFQEahoZgkvFz9Lh7M2LS48nKXH8OSe9RioBpFLXgVWy7bl4hN8qng8kC0IJWIHMWUKgn4zhOd8xR&sig=Cg0ArKJSzKEXMKx6refjEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=156&cbvp=1&cstd=153&cisv=r20210517.71373&adurl=

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

src=10750551;dc_pre=COOcysXW5PACFZOqGAodoLsBIw;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=2407762559
adservice.google.com/ddm/fls/z/ Frame 7011
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=10750551;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=2407762559?
https://ad.doubleclick.net/ddm/activity/src=10750551;dc_pre=COOcysXW5PACFZOqGAodoLsBIw;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=2...
https://adservice.google.com/ddm/fls/z/src=10750551;dc_pre=COOcysXW5PACFZOqGAodoLsBIw;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=24...

42 B
262 B

42ms
42ms

Image
image/gif

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=10750551;dc_pre=COOcysXW5PACFZOqGAodoLsBIw;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=2407762559

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=10750551;dc_pre=COOcysXW5PACFZOqGAodoLsBIw;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=2407762559
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 index.html
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 68 KB
7 KB 14ms
14ms Document
text/html 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 6739
date: Tue, 25 May 2021 10:58:41 GMT
expires: Wed, 26 May 2021 10:58:41 GMT
cache-control: public, max-age=86400
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 01ED 0
61 B 66ms
65ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssyF1mmvRyFVJbO1FNuagtCzKqfIbGB7sOCO9DI6OG5IpDkj0uq3SrEVVamYap-cvEcTOJj_TZowK--d-hdtHjuiHiq4ivGQNoqsCL2GQ2KWOA1jvBBFviSvOGwW8bhxrjVFjzt-IclKt9HypKN1RyhaLwvdEcOISPBB935WZiVHm-VnCTKE1d2E2yJblNdsJNlNtkM5SjiYopVhm056JB4rd79d9wEUGZA_71RtAppBFSZC04pK-eGG7gWuQ9NYAWGRPa7qffT7Hol6RX9DNbChcIh4A30w7n3AMtEskr6yfDgfuOWWYCMUpvhhhXVOBxAPckOPzCqnBAikDRPp4Cu8iFGV1_WF1STNfVtS3sAYNksM_hdZqQZjCu3CTNxA_CkhjQ2rSwaFF6M_xQdsy3BoK_TYzD_5Mnht9_xLi51Yr3HEO8MItR2FmnrrtMhrrDOMqMYBjbDcPlHww4BP_pr3LYsaqIvtUWvn3RGRNbf31v3nMmy8vMWeYcqRX3x1xh2q-jVuOWhmoTViJUS_3FbNGLTpOC9f7h4MKoiX0W-fUYCKaJwGdpbmdxNjzm1PAtmklsoMee6i7rmciKlCxR4BIKBUI0e7M9LBikpuVhMtnBSYgwhdEwC3S1D6mG8fog76FuxdPuah8lzR7BLheAHwM-ngNJbugXS4PFvAneP45NvEP-oBHzxII8itQ6j28D3IQSNfn1CE1Ii6eYVBbsidvGskKiLq-f7gXCtGK3EXpha5qxtE92-j1E13CfZwGojxd4ueAAdPQJgu6HFKb242KUDfE9SY7o2XMOv0ukw6E-7i5EI_tBGJ-OPqGSjHE2xdkBj3uPLL6eRFqMDScEMDpxZC8P-8Iy_gwDc9RJNMWGY3YARTJNQaYn86faFJt0RKcIlymU9x0Y5P2RUixYbN6GT891JAMnmoEBHL15XG9eyioSBhMPt4VG9EMGufOckkm6BEgAdRBWskROOgG9171ub7_GLX57lywrO7KkcQ4RfvCUZc2tB1hxkMz2Vqf0y6kq4bTN3yjgt3ewnA-ENz3DMoDa79mV44o0iEbgMIf0qVLdF56MV0SUJvtuM0frvAwMdfqfZD77v3rdGvKJ7STm2MBkZaQq3cmSD6_sMgCF6zvNku3RTbOogNIdN0iL5JI0zq8afjAQMXRNLnAm9NGh8aV1Uka6Xz6AKf0TwRjqMULbHQd8&sai=AMfl-YT2whfJZ8tL6eglfbi0N_YBE8GZWdsN09a5230del_0iVIJubA9WzentIDAt4Fxo95KD3EyRY6fMFW_p4Q3wwxMZsMOl9JVnrXzGq6-I5YFIw_v-9XJNHpK1ScBPpu8b_NehbPpzsdlXi4T2-dJEdM6SiGLJWEXzSZEFs2uy-MqpMX5ygoz&sig=Cg0ArKJSzE45X5cbjXe7EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=142&cbvp=1&cstd=138&cisv=r20210517.23381&adurl=

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 25 May 2021 10:58:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK tag.tr
red.vtracy.de/ Frame 6CA7 16 KB
17 KB 10ms
10ms Script
text/javascript 52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://red.vtracy.de/tag.tr?tr_adid=k25762587_s6701753_p301404700_c149615219&tr_mid=0&tr_sync=true&tr_uid1=DC&gdpr_consent=&gdpr=&t=1068114230
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: Apache
Connection: keep-alive
Content-Length: 16726
Content-Type: text/javascript;charset=UTF-8

GET
H3-29 200 index.html
s0.2mdn.net/10750551/1619025170727/Suewag_ServiceApp_MotivZ_300x250/ Frame 8E7B 3 KB
1 KB 6ms
6ms Document
text/html 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10750551/1619025170727/Suewag_ServiceApp_MotivZ_300x250/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /10750551/1619025170727/Suewag_ServiceApp_MotivZ_300x250/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1125
date: Mon, 24 May 2021 15:35:37 GMT
expires: Tue, 25 May 2021 15:35:37 GMT
last-modified: Wed, 21 Apr 2021 17:12:50 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 69784
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 6CA7 0
60 B 41ms
40ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu-r0px7ll89nGg0PkAdfaCj_DPJTJxY1pf7kG7SlZWtySHw6bQofX2KkcH95wn1wH91RFP1oDPjlpbJhPVb25YeMiE2X8pCQqBXwF3tYPSmXXMaPpKVH1KSbDA-73mg7i0O1PmZoS2p86stQpihuEAz9PH-MKm4g&sig=Cg0ArKJSzKHljmC70RAdEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=138&cbvp=1&cstd=136&cisv=r20210517.03876&adurl=

Requested by

Host: trovas.ch
URL: https://trovas.ch/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 25 May 2021 10:58:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2

200

src=10750551;dc_pre=COjAzsXW5PACFcUUGAodYVQJ7Q;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1068114230
adservice.google.com/ddm/fls/z/ Frame 6CA7
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=10750551;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1068114230?
https://ad.doubleclick.net/ddm/activity/src=10750551;dc_pre=COjAzsXW5PACFcUUGAodYVQJ7Q;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1...
https://adservice.google.com/ddm/fls/z/src=10750551;dc_pre=COjAzsXW5PACFcUUGAodYVQJ7Q;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=10...

42 B
107 B

41ms
41ms

Image
image/gif

2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=10750551;dc_pre=COjAzsXW5PACFcUUGAodYVQJ7Q;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1068114230

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
location: https://adservice.google.com/ddm/fls/z/src=10750551;dc_pre=COjAzsXW5PACFcUUGAodYVQJ7Q;type=suewa0;cat=servi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=;gdpr_consent=;ord=1068114230
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29 200 UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 01ED 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 05:20:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 20286
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 25 May 2022 05:20:35 GMT

GET
H3-29 200 cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 5736 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Tue, 25 May 2021 06:38:34 GMT
expires: Wed, 26 May 2021 06:38:34 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 15607
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 01ED 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9f5fc29babb6dcf8ab5ec657981c195d6c533b51addab9ae869af9c7a6417e5d

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B62C
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEGfyWAF2TPkMBDaVgM_TRw&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEGfyWAF2TPkMBDaVgM_TRw&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SmR5eldyMHAxTEx1TEw1&google_gid=CAESEEGfyWAF2TPkMBDaVgM_TRw&google_cver=1&google_push=AQvitUJJL5-bAishFVc8at39Hr4EgF6TE5Akqmfuqwgspsj...

170 B
188 B

24ms
24ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SmR5eldyMHAxTEx1TEw1&google_gid=CAESEEGfyWAF2TPkMBDaVgM_TRw&google_cver=1&google_push=AQvitUJJL5-bAishFVc8at39Hr4EgF6TE5Akqmfuqwgspsj4x77Q2NTfx681JoF8lPfVlS31Z16DgByOTnZBR4rDNXwBeWQ_8lyZ

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 25 May 2021 10:58:41 GMT
Server: PingMatch/v2.0.30-649-g03fe1b8#rel-ec2-master i-0a1405953f2666354@eu-central-1a@dxedge-app-eu-central-1-prod-asg
P3P: policyref="https://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=SmR5eldyMHAxTEx1TEw1&google_gid=CAESEEGfyWAF2TPkMBDaVgM_TRw&google_cver=1&google_push=AQvitUJJL5-bAishFVc8at39Hr4EgF6TE5Akqmfuqwgspsj4x77Q2NTfx681JoF8lPfVlS31Z16DgByOTnZBR4rDNXwBeWQ_8lyZ
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B62C
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEEt_bx-SElGDg3gE2U6G6xM&google_cver=1&google_push=AQvitUIosRCskdFdbU5TeYaoxVXTRu-_KGzsaY4Ggm3QS7fwEsmzX_lhey6qvvwDfFGSSYdeuNyziMZZGEF61T4x...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=AH1U6ZFbQJqMAIcAviImqQ2&google_push=AQvitUIosRCskdFdbU5TeYaoxVXTRu-_KGzsaY4Ggm3QS7fwEsmzX_lhey6qvvwDfFGSSYdeuNyziMZZGEF61T4xwu4siMEh3xkS

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=AH1U6ZFbQJqMAIcAviImqQ2&google_push=AQvitUIosRCskdFdbU5TeYaoxVXTRu-_KGzsaY4Ggm3QS7fwEsmzX_lhey6qvvwDfFGSSYdeuNyziMZZGEF61T4xwu4siMEh3xkS

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 25 May 2021 10:58:41 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=AH1U6ZFbQJqMAIcAviImqQ2&google_push=AQvitUIosRCskdFdbU5TeYaoxVXTRu-_KGzsaY4Ggm3QS7fwEsmzX_lhey6qvvwDfFGSSYdeuNyziMZZGEF61T4xwu4siMEh3xkS
x-host: tde-deliveryengine-production-69f4c6966c-qnn4x
alt-svc: clear
content-length: 0

GET adxcookie
match.adsby.bidtheatre.com/ Frame B62C 0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B62C
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEITbvZZQ5SqxcIZPg1jVL5g&google_cver=1&google_push=AQvitUKRpavLuJ0zjfbX8nr21cGjenVN9SVFmWE4eeL0IecGrXV0N5wsrBNASSzWMRqzBTCTjotRhzs66H0wWhcRmqGKdRs...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AQvitUKRpavLuJ0zjfbX8nr21cGjenVN9SVFmWE4eeL0IecGrXV0N5wsrBNASSzWMRqzBTCTjotRhzs66H0wWhcRmqGKdRs2glql&google_hm=NzU5Mjg3NzA4Nzg1NjcwOT...

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AQvitUKRpavLuJ0zjfbX8nr21cGjenVN9SVFmWE4eeL0IecGrXV0N5wsrBNASSzWMRqzBTCTjotRhzs66H0wWhcRmqGKdRs2glql&google_hm=NzU5Mjg3NzA4Nzg1NjcwOTkyMg%3D%3D

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 25 May 2021 10:58:41 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AQvitUKRpavLuJ0zjfbX8nr21cGjenVN9SVFmWE4eeL0IecGrXV0N5wsrBNASSzWMRqzBTCTjotRhzs66H0wWhcRmqGKdRs2glql&google_hm=NzU5Mjg3NzA4Nzg1NjcwOTkyMg%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B62C
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEAxJBfpV9aaaAboiq7CLnoM&google_cver=1&google_push=AQvitUJkpHp-SbjUHEe1xbqXghMX5KvMb8Ly6M7xtti5PVsn5eZjj-ekZ0KSXZmPbaHVxY8AuEMogJkU...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEAxJBfpV9aaaAboiq7CLnoM&google_cver=1&google_push=AQvitUJkpHp-SbjUHEe1xbqXghMX5KvMb8Ly6M7xtti5PVsn5eZjj-ekZ0KSXZmPbaHVxY8AuEM...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzY5OTkzMjQ5ODQzMzU3ODY0NQ&google_push=AQvitUJkpHp-SbjUHEe1xbqXghMX5KvMb8Ly6M7xtti5PVsn5eZjj-ekZ0KSXZmPbaHVxY8AuEMogJ...

170 B
188 B

39ms
23ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzY5OTkzMjQ5ODQzMzU3ODY0NQ&google_push=AQvitUJkpHp-SbjUHEe1xbqXghMX5KvMb8Ly6M7xtti5PVsn5eZjj-ekZ0KSXZmPbaHVxY8AuEMogJkUPR0mlLcQf3qhVAbXJ8AB

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzY5OTkzMjQ5ODQzMzU3ODY0NQ&google_push=AQvitUJkpHp-SbjUHEe1xbqXghMX5KvMb8Ly6M7xtti5PVsn5eZjj-ekZ0KSXZmPbaHVxY8AuEMogJkUPR0mlLcQf3qhVAbXJ8AB
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B62C
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEAYW3TkS0b7V_qaxhOesP7A&google_cver=1&google_push=AQvitUIDVApfi4gX0UmjEK3a744KnkdmTCKttPLSf3UuYxp0hhwAqdgl...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEAYW3TkS0b7V_qaxhOesP7A&google_cver=1&google_push=AQvitUIDVApfi4gX0UmjEK3a744KnkdmTCKttPLSf3UuYxp0hhwAqdgl...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEAYW3TkS0b7V_qaxhOesP7A&google_cver=1&google_push=AQvitUIDVApfi4gX0UmjEK3a744KnkdmTCKttPLSf3UuYxp0hhwAqd...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVAyYTk1M2IwNS1iZDQ4LTExZWItYWFkOC0wMmYyNGE2OWUwNGE%3D&google_push=AQvitUIDVApfi4gX0UmjEK3a744KnkdmTCKttPLSf3UuYxp0hhwAqdglhUl0foLKU-...

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVAyYTk1M2IwNS1iZDQ4LTExZWItYWFkOC0wMmYyNGE2OWUwNGE%3D&google_push=AQvitUIDVApfi4gX0UmjEK3a744KnkdmTCKttPLSf3UuYxp0hhwAqdglhUl0foLKU-A2SfC0JG9Ug-qgq3k2oYBIQj__tLGcpqZv

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVAyYTk1M2IwNS1iZDQ4LTExZWItYWFkOC0wMmYyNGE2OWUwNGE%3D&google_push=AQvitUIDVApfi4gX0UmjEK3a744KnkdmTCKttPLSf3UuYxp0hhwAqdglhUl0foLKU-A2SfC0JG9Ug-qgq3k2oYBIQj__tLGcpqZv
Connection: keep-alive
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame B62C
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEJ98Zgs7EOIt6Kz3zKw7Ezg&google_cver=1&google_push=AQvitULT0BJ3updblDjZ1oyHVxXb5XF2Pmz4TDlg45Q1WwiD0wTqe9S6fksKBgUtzixGClW_fPMC-0tQ8KmsL6PuS...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MDk3YWQ5OWYtNzIzYi00ZjliLWFiNGQtM2I0YTQwYmM4MDA5&google_push=AQvitULT0BJ3updblDjZ1oyHVxXb5XF2Pmz4TDlg45Q1WwiD0wTqe9S6fksKBgUt...

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MDk3YWQ5OWYtNzIzYi00ZjliLWFiNGQtM2I0YTQwYmM4MDA5&google_push=AQvitULT0BJ3updblDjZ1oyHVxXb5XF2Pmz4TDlg45Q1WwiD0wTqe9S6fksKBgUtzixGClW_fPMC-0tQ8KmsL6PuSIJ9GEheDr8yoQ

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MDk3YWQ5OWYtNzIzYi00ZjliLWFiNGQtM2I0YTQwYmM4MDA5&google_push=AQvitULT0BJ3updblDjZ1oyHVxXb5XF2Pmz4TDlg45Q1WwiD0wTqe9S6fksKBgUtzixGClW_fPMC-0tQ8KmsL6PuSIJ9GEheDr8yoQ
date: Tue, 25 May 2021 10:58:41 GMT
content-length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame B62C 0
50 B 15ms
14ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IV6SCmhE_LxmSR9FnijVHmaf9XYIbdabr0Sn35QvBP7LtJXR7CLbfJWcnxrKjACSxw_QytY5o

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2

200

skeleton.js
static.adsafeprotected.com/ Frame 7011
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/695971/54149679/skeleton.js?adsafe_url=https%3A%2F%2Ftrovas.ch%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Ffc7199084b88b6cf5f078f82277d42fa.safeframe.googlesy...
https://static.adsafeprotected.com/skeleton.js

17 B
240 B

28ms
28ms

Script
application/javascript

52.213.246.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.246.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-246-12.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: nginx/1.16.1
age: 6630420
etag: "53fab767ecbd3bf07990b10246befbd4"
x-cache-status: HIT
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 17

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-server-name: app35.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.5.js
static.adsafeprotected.com/ Frame 8B55 82 KB
21 KB 30ms
28ms Script
application/javascript 52.213.246.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.5.js
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.246.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-246-12.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Apr 2021 15:29:23 GMT
server: nginx/1.16.1
age: 1696509
etag: W/"5356fa8b6073c3eb408487be61ef7d77"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000

GET
H2

200

skeleton.js
static.adsafeprotected.com/ Frame 6CA7
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/695971/54149679/skeleton.js?adsafe_url=https%3A%2F%2Ftrovas.ch%2F&adsafe_type=e&adsafe_url=https%3A%2F%2Ffc7199084b88b6cf5f078f82277d42fa.safeframe.googlesy...
https://static.adsafeprotected.com/skeleton.js

17 B
240 B

30ms
28ms

Script
application/javascript

52.213.246.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.246.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-246-12.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: nginx/1.16.1
age: 5269090
etag: "53fab767ecbd3bf07990b10246befbd4"
x-cache-status: HIT
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 17

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-server-name: app03.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.5.js
static.adsafeprotected.com/ Frame E44E 82 KB
21 KB 29ms
29ms Script
application/javascript 52.213.246.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.5.js
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.213.246.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-213-246-12.eu-west-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
content-encoding: gzip
last-modified: Thu, 29 Apr 2021 15:29:23 GMT
server: nginx/1.16.1
age: 1696858
etag: W/"5356fa8b6073c3eb408487be61ef7d77"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000

GET
H/1.1 200
OK c.gif
red.vtracy.de/ Frame 7011 42 B
251 B 11ms
8ms Image
image/gif 52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red.vtracy.de/c.gif?u1=1&u2=https://trovas.ch/&u3=&u4=https://trovas.ch/&u5=&u6=&u7=SafeFrame%20Container&u8=&u9=&u10=&u11=&v1=120&v2=1621940321550&v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&v3dt=2021-05-25%2012:58:41&v3gsd=&v3aasd=&v3runsd=&v3ttdsd=&v3adfsd=&v4=1&v6=0&v7=1600x1200&v8=24&v9=undefined&v10=&v11=&v12=2&v13=3&v15=IF&c1=k25762587_s6701753_p301404700_c149509254&c2=1&request_unique_id=YKzYYX7hekSVGMXvy03X2wAAAFI&gdpr=&gdpr_consent=&tr_mid=0&tr_uid1=DC&tr_m=&t=91780574249&source=js&ls=false
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Last-Modified: Mon, 17 May 2021 08:55:24 GMT
Server: Apache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42
Content-Type: image/gif

GET
H/1.1

200
OK

tr_aa
red.vtracy.de/ Frame 7011
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A//red.vtracy.de/tr_aa%3Fv3%3Dvi-29f5078e-95e0-4c5c-b964-24ffa5129e4e%26adid%3Dk25762587_s6701753_p301404700_c149509254%26userId%3D%25%25COOK...
https://red.vtracy.de/tr_aa?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149509254&userId=6966180634774534284&tr_timestamp=1621940321552

49 B
478 B

31ms
9ms

Image
image/gif

52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red.vtracy.de/tr_aa?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149509254&userId=6966180634774534284&tr_timestamp=1621940321552
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: Apache
Vary: negotiate
Content-Type: image/gif
Cache-Control: must-revalidate
TCN: choice
Connection: keep-alive
Content-Location: tr_aa.tr
Content-Length: 49
Expires: Wed, 5 Feb 1986 06:06:06 GMT

Redirect headers

Location: https://red.vtracy.de/tr_aa?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149509254&userId=6966180634774534284&tr_timestamp=1621940321552
Date: Tue, 25 May 2021 10:58:41 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H/1.1

200
OK

tr_cm
red.vtracy.de/ Frame 7011
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=vivakide_dmp2&google_cm&v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149509254&tr_timestamp=1621940321552
https://red.vtracy.de/tr_cm?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149509254&tr_timestamp=1621940321552&google_gid=CAESEEo0ES3OEphuRxZQgX0AKF8&google_cver=1

49 B
477 B

9ms
8ms

Image
image/gif

52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red.vtracy.de/tr_cm?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149509254&tr_timestamp=1621940321552&google_gid=CAESEEo0ES3OEphuRxZQgX0AKF8&google_cver=1
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: Apache
Vary: negotiate
Content-Type: image/gif
Cache-Control: must-revalidate
TCN: choice
Connection: keep-alive
Content-Location: tr_cm.tr
Content-Length: 49
Expires: Wed, 5 Feb 1986 06:06:06 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://red.vtracy.de/tr_cm?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149509254&tr_timestamp=1621940321552&google_gid=CAESEEo0ES3OEphuRxZQgX0AKF8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 409
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

tr_ttd.tr
red.vtracy.de/ Frame 7011
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=m82k10l&ttd_tpi=1&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e
https://match.adsrvr.org/track/cmb/generic?ttd_pid=m82k10l&ttd_tpi=1&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e
https://red.vtracy.de/tr_ttd.tr?&tdid=43d1c7ae-5975-44a6-bbad-bc289af0039c&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e

49 B
421 B

9ms
8ms

Image
image/gif

52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red.vtracy.de/tr_ttd.tr?&tdid=43d1c7ae-5975-44a6-bbad-bc289af0039c&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Cache-Control: must-revalidate
Expires: Wed, 5 Feb 1986 06:06:06 GMT
Server: Apache
Connection: keep-alive
Content-Length: 49
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://red.vtracy.de/tr_ttd.tr?&tdid=43d1c7ae-5975-44a6-bbad-bc289af0039c&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 375

GET

i.match
s.tribalfusion.com/z/ Frame 3C30
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEF2QMQcg5FB_OOvIFWmyHcs&google_cver=1&google_push=AQvitUIIcgqXhTG5fmE_AdUD_sGd0RfAREjgEUpWB2mb08v5CqNfKptU9QY-i3FIuK1eMKgs-0PkE_C5JvV4HkiQlvGx7VSN8j56&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEF2QMQcg5FB_OOvIFWmyHcs&google_cver=1&google_push=AQvitUIIcgqXhTG5fmE_AdUD_sGd0RfAREjgEUpWB2mb08v5CqNfKptU9QY-i3FIuK1eMKgs-0PkE_C5JvV4HkiQlvGx7VSN8j5...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3C30
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEIT2rkcFY3XC7mT7AzrkLZQ&google_cver=1&google_push=AQvitUKRtNmcQ_GRqjRZDR_P_1Yc78d9qAuCa4A0u_iA2e4JEvTs6lhFKFNw2Bcr2VDpp64R7SC5tF2sEreB1I...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk2NjE4MDYzNDc3NDA3NTUzNg%3D%3D&google_push=AQvitUKRtNmcQ_GRqjRZDR_P_1Yc78d9qAuCa4A0u_iA2e4JEvTs6lhFKFNw2Bcr2VDpp64R7SC5tF2sEreB1If86L...

170 B
188 B

22ms
22ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk2NjE4MDYzNDc3NDA3NTUzNg%3D%3D&google_push=AQvitUKRtNmcQ_GRqjRZDR_P_1Yc78d9qAuCa4A0u_iA2e4JEvTs6lhFKFNw2Bcr2VDpp64R7SC5tF2sEreB1If86L-Zvw56c7mD

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=Njk2NjE4MDYzNDc3NDA3NTUzNg%3D%3D&google_push=AQvitUKRtNmcQ_GRqjRZDR_P_1Yc78d9qAuCa4A0u_iA2e4JEvTs6lhFKFNw2Bcr2VDpp64R7SC5tF2sEreB1If86L-Zvw56c7mD
Date: Tue, 25 May 2021 10:58:41 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET

sync
x.bidswitch.net/ Frame 3C30
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEP3eIJtH3mU5E6_YpSz7Lw4&google_cver=1&google_push=AQvitULNbB1ZYxH4CIkaDEyUsUsSez_AAntpDbc_tQ2Mi02WIaA8mAosd4pNus5-1IzkPVySO655buh6LFK859SVIC53...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEP3eIJtH3mU5E6_YpSz7Lw4&google_cver=1&google_push=AQvitULNbB1ZYxH4CIkaDEyUsUsSez_AAntpDbc_tQ2Mi02WIaA8mAosd4pNus5-1IzkPVySO655buh6LFK859...
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=b20b0cc3-c831-4396-8c1d-3a1c5dc8374e
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=b20b0cc3-c831-4396-8c1d-3a1c5dc8374e
https://x.bidswitch.net/sync?dsp_id=4&user_id=9c529c0b-4a9a-4757-ba9a-cd75213a8aa3&ssp=google&expires=30&user_group=5&bsw_param=b20b0cc3-c831-4396-8c1d-3a1c5dc8374e

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3C30
Redirect Chain

https://sync3.sniperlog.ru/?src=ggl_nga&google_gid=CAESEOqaTJRmqs8TfK0_vzoxVq0&google_cver=1&google_push=AQvitUKezk3g4vgJqdB6_gPTUDAua3eixz0zlWv19H273ss951hxieCrF0qX71rSDC0QFfwbsbiYveUzVHgF4SzUP60D...
https://sync.bumlam.com/?src=ggl_nga&google_gid=CAESEOqaTJRmqs8TfK0_vzoxVq0&google_cver=1&google_push=AQvitUKezk3g4vgJqdB6_gPTUDAua3eixz0zlWv19H273ss951hxieCrF0qX71rSDC0QFfwbsbiYveUzVHgF4SzUP60DrWS...
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AQvitUKezk3g4vgJqdB6_gPTUDAua3eixz0zlWv19H273ss951hxieCrF0qX71rSDC0QFfwbsbiYveUzVHgF4SzUP60DrWSapWvr

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AQvitUKezk3g4vgJqdB6_gPTUDAua3eixz0zlWv19H273ss951hxieCrF0qX71rSDC0QFfwbsbiYveUzVHgF4SzUP60DrWSapWvr

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AQvitUKezk3g4vgJqdB6_gPTUDAua3eixz0zlWv19H273ss951hxieCrF0qX71rSDC0QFfwbsbiYveUzVHgF4SzUP60DrWSapWvr
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3C30
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=PtvquNSRR4WR3N_X8ENXAA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=PtvquNSRR4WR3N_X8ENXAA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUKw-LLEpEm0eyZjjiNnVBWkLcM9oTmmJcIQJdgxaB6qsQM1KdXwewSv4rOqbyMBfe2IGNdTa-Y-lc-EDTmIjd8gi1Ygm_AP

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=PtvquNSRR4WR3N_X8ENXAA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AQvitUKw-LLEpEm0eyZjjiNnVBWkLcM9oTmmJcIQJdgxaB6qsQM1KdXwewSv4rOqbyMBfe2IGNdTa-Y-lc-EDTmIjd8gi1Ygm_AP
date: Tue, 25 May 2021 10:58:41 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3C30
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEORtqYxh1botwoBBNlrY9hg&google_cver=1&google_push=AQvitULVtRPKp45btNT-zfzqEHlaTwryCo1_IltLpSQjJMCz5aiLkBbV0PzUU81cUzTCTeFQO1H11DoIuQ_CES5AX...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEORtqYxh1botwoBBNlrY9hg&google_cver=1&google_push=AQvitULVtRPKp45btNT-zfzqEHlaTwryCo1_IltLpSQjJMCz5aiLkBbV0PzUU81cUzTCTeFQO1H11DoIuQ_CES5AX...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AQvitULVtRPKp45btNT-zfzqEHlaTwryCo1_IltLpSQjJMCz5aiLkBbV0PzUU81cUzTCTeFQO1H11DoIuQ_CES5AXKVJuUJDWhmK&google_hm=ff6882aa5051e093804b368c

0
0

17ms
17ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AQvitULVtRPKp45btNT-zfzqEHlaTwryCo1_IltLpSQjJMCz5aiLkBbV0PzUU81cUzTCTeFQO1H11DoIuQ_CES5AXKVJuUJDWhmK&google_hm=ff6882aa5051e093804b368c

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: nginx
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=AQvitULVtRPKp45btNT-zfzqEHlaTwryCo1_IltLpSQjJMCz5aiLkBbV0PzUU81cUzTCTeFQO1H11DoIuQ_CES5AXKVJuUJDWhmK&google_hm=ff6882aa5051e093804b368c
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap7ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 3C30
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEK6752iA1w1T_QX4JMILfn0&google_cver=1&google_push=AQvitUKSpmePva5tmcRRf-IPeOConxjQT1r6L5XJhzOklDcWmE7drLPraJNpX1_mK3qqSvSqbzxYmsv-BrarbKYH4bPZau8qU2S5
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AQvitUKSpmePva5tmcRRf-IPeOConxjQT1r6L5XJhzOklDcWmE7drLPraJNpX1_mK3qqSvSqbzxYmsv-BrarbKYH4bPZau8qU2S5&goog...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTgwOTM0OTE2NjY0OTg5OTg0&google_push=AQvitUKSpmePva5tmcRRf-IPeOConxjQT1r6L5XJhzOklDcWmE7drLPraJNpX1_mK3qq...

170 B
188 B

20ms
17ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTgwOTM0OTE2NjY0OTg5OTg0&google_push=AQvitUKSpmePva5tmcRRf-IPeOConxjQT1r6L5XJhzOklDcWmE7drLPraJNpX1_mK3qqSvSqbzxYmsv-BrarbKYH4bPZau8qU2S5

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NTgwOTM0OTE2NjY0OTg5OTg0&google_push=AQvitUKSpmePva5tmcRRf-IPeOConxjQT1r6L5XJhzOklDcWmE7drLPraJNpX1_mK3qqSvSqbzxYmsv-BrarbKYH4bPZau8qU2S5
date: Tue, 25 May 2021 10:58:41 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 3C30 0
12 B 17ms
16ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KgHal4gMDU5jSG9aP9RNXvWqYFvsP9SYkRSnh-3SGTbnB--zU38Unrvyh1ZR-UBhGVaBbf

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pixel.gif
px.moatads.com/ Frame CE07 43 B
260 B 18ms
11ms Image
image/gif 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&pxm=3&sgs=3&vb=-1&kq=1&lo=0&uk=null&pk=0&wk=0&rk=0&tk=0&ak=-&i=ESSENCEDIGITALEMEA1&ol=3324430317&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=2%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-1cQ31u7Cex5YkrqdycYLLo%2BX1UC%2FyeTy8j%2F4uhjkxPYPVB9OTwGYDFJZ&sc=1&os=1-mQ%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=300&qe=250&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&zMoatGSR=1&ph=&pj=standard&zGSRC=1&gu=https%3A%2F%2Ftrovas.ch%2F&id=0&ii=3&f=1&j=https%3A%2F%2Ftrovas.ch&lp=https%3A%2F%2Ftrovas.ch&t=1621940316132&de=156590672549&cu=1621940316132&m=5441&ar=c498f16-clean&iw=4ce2857&cb=0&ym=0&ll=2&lm=1&ln=1&r=0&dl=0&nh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=250&le=1&lf=105&lg=1&lh=36&gm=1&io=1&ch=1&vv=3&vw=0%3A3%3A0&vp=100&vx=-%3A100%3A-&pe=0%3A156%3A156%3A1386%3A151&aa=1&ad=5306&cn=1078&gn=1&gk=5306&gl=1078&ik=5306&ic=5306&ez=1&co=1078&cp=1003&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5118&cd=1003&ah=5118&am=1003&xd=00&rf=0&re=1&wb=2&cl=0&at=0&d=25733733%3A6046251%3A302186077%3A149649403&bo=trovas.ch&bd=trovas.ch&gw=essencedigitalemeav2553596143685&zMoatOrigSlicer1=N%2FA&zMoatOrigSlicer2=N%2FA&zMoatAUCID=-&zMoatENV=j&hv=findIframeAds&ab=2&ac=1&fd=1&kt=sframe&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&jk=6&jm=-1&tc=0&fs=191618&na=264299000&cs=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
last-modified: Fri, 20 May 2016 15:16:00 GMT
server: AkamaiNetStorage
etag: "ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
accept-ranges: bytes
content-length: 43
expires: Tue, 25 May 2021 10:58:41 GMT

GET
H/1.1

200
OK

tr_ttd.tr
red.vtracy.de/ Frame 6CA7
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=m82k10l&ttd_tpi=1&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e
https://red.vtracy.de/tr_ttd.tr?&tdid=43d1c7ae-5975-44a6-bbad-bc289af0039c&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e

49 B
735 B

24ms
9ms

Image
image/gif

52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red.vtracy.de/tr_ttd.tr?&tdid=43d1c7ae-5975-44a6-bbad-bc289af0039c&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Cache-Control: must-revalidate
Expires: Wed, 5 Feb 1986 06:06:06 GMT
Server: Apache
Connection: keep-alive
Content-Length: 49
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://red.vtracy.de/tr_ttd.tr?&tdid=43d1c7ae-5975-44a6-bbad-bc289af0039c&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&ttd_puid=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 375

GET
H/1.1 200
OK c.gif
red.vtracy.de/ Frame 6CA7 42 B
251 B 10ms
8ms Image
image/gif 52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red.vtracy.de/c.gif?u1=1&u2=https://trovas.ch/&u3=&u4=https://trovas.ch/&u5=&u6=&u7=SafeFrame%20Container&u8=&u9=&u10=&u11=&v1=120&v2=1621940321594&v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&v3dt=2021-05-25%2012:58:41&v3gsd=&v3aasd=&v3runsd=&v3ttdsd=&v3adfsd=&v4=1&v6=0&v7=1600x1200&v8=24&v9=undefined&v10=&v11=&v12=2&v13=3&v15=IF&c1=k25762587_s6701753_p301404700_c149615219&c2=1&request_unique_id=YKzYYX7hekSVGMXvy03X3QAAAFI&gdpr=&gdpr_consent=&tr_mid=0&tr_uid1=DC&tr_m=&t=28668924484&source=js&ls=false
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Last-Modified: Mon, 17 May 2021 08:55:24 GMT
Server: Apache
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 42
Content-Type: image/gif

GET
H/1.1

200
OK

tr_aa
red.vtracy.de/ Frame 6CA7
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?redirect=https%3A//red.vtracy.de/tr_aa%3Fv3%3Dvi-29f5078e-95e0-4c5c-b964-24ffa5129e4e%26adid%3Dk25762587_s6701753_p301404700_c149615219%26userId%3D%25%25COOK...
https://red.vtracy.de/tr_aa?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149615219&userId=6966180634774534284&tr_timestamp=1621940321596

49 B
478 B

32ms
9ms

Image
image/gif

52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red.vtracy.de/tr_aa?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149615219&userId=6966180634774534284&tr_timestamp=1621940321596
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: Apache
Vary: negotiate
Content-Type: image/gif
Cache-Control: must-revalidate
TCN: choice
Connection: keep-alive
Content-Location: tr_aa.tr
Content-Length: 49
Expires: Wed, 5 Feb 1986 06:06:06 GMT

Redirect headers

Location: https://red.vtracy.de/tr_aa?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149615219&userId=6966180634774534284&tr_timestamp=1621940321596
Date: Tue, 25 May 2021 10:58:41 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H/1.1

200
OK

tr_cm
red.vtracy.de/ Frame 6CA7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=vivakide_dmp2&google_cm&v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149615219&tr_timestamp=1621940321597
https://red.vtracy.de/tr_cm?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149615219&tr_timestamp=1621940321597&google_gid=CAESEEo0ES3OEphuRxZQgX0AKF8&google_cver=1

49 B
477 B

33ms
9ms

Image
image/gif

52.29.133.163
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://red.vtracy.de/tr_cm?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149615219&tr_timestamp=1621940321597&google_gid=CAESEEo0ES3OEphuRxZQgX0AKF8&google_cver=1
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.29.133.163 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 25 May 2021 10:58:41 GMT
Server: Apache
Vary: negotiate
Content-Type: image/gif
Cache-Control: must-revalidate
TCN: choice
Connection: keep-alive
Content-Location: tr_cm.tr
Content-Length: 49
Expires: Wed, 5 Feb 1986 06:06:06 GMT

Redirect headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://red.vtracy.de/tr_cm?v3=vi-29f5078e-95e0-4c5c-b964-24ffa5129e4e&adid=k25762587_s6701753_p301404700_c149615219&tr_timestamp=1621940321597&google_gid=CAESEEo0ES3OEphuRxZQgX0AKF8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 409
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 3D26 22 KB
8 KB 6ms
5ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Tue, 25 May 2021 05:20:35 GMT
expires: Wed, 25 May 2022 05:20:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 20286
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 anim.min.js
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 8 KB
3 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/anim.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 05:30:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19709
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3425
x-xss-protection: 0
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 26 May 2021 05:30:12 GMT

GET
H2 200 polyfill.js
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 6 KB
2 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/polyfill.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 06:06:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17552
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1955
x-xss-protection: 0
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Wed, 26 May 2021 06:06:09 GMT

GET
H3-29 200 app.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 5 KB
5 KB 8ms
7ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/app.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 04:10:47 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 24474
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4693
x-xss-protection: 0
expires: Wed, 26 May 2021 04:10:47 GMT

GET
H3-29 200 stoerer1.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 4 KB
4 KB 8ms
7ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/stoerer1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:05:30 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 3191
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3824
x-xss-protection: 0
expires: Wed, 26 May 2021 10:05:30 GMT

GET
H3-29 200 copy1.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 14 KB
14 KB 14ms
9ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/copy1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:15:25 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 2596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13855
x-xss-protection: 0
expires: Wed, 26 May 2021 10:15:25 GMT

GET
H3-29 200 copy2.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 11 KB
11 KB 14ms
9ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/copy2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:05:30 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 3191
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10945
x-xss-protection: 0
expires: Wed, 26 May 2021 10:05:30 GMT

GET
H3-29 200 copy3.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 6 KB
6 KB 18ms
13ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/copy3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:15:25 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 2596
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6155
x-xss-protection: 0
expires: Wed, 26 May 2021 10:15:25 GMT

GET
H3-29 200 copy4.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 12 KB
12 KB 33ms
28ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/copy4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:05:30 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 3191
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11787
x-xss-protection: 0
expires: Wed, 26 May 2021 10:05:30 GMT

GET
H3-29 200 copy5.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 10 KB
10 KB 30ms
25ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/copy5.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:05:30 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 3191
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10027
x-xss-protection: 0
expires: Wed, 26 May 2021 10:05:30 GMT

GET
H3-29 200 copy6.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 9 KB
9 KB 32ms
26ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/copy6.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:05:30 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 3191
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9221
x-xss-protection: 0
expires: Wed, 26 May 2021 10:05:30 GMT

GET
H3-29 200 gwdpage_style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 55 B
83 B 10ms
6ms Stylesheet
text/css 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdpage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 05:10:27 GMT
x-content-type-options: nosniff
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
age: 20894
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 55
x-xss-protection: 0
expires: Wed, 26 May 2021 05:10:27 GMT

GET
H3-29 200 gwdpagedeck_style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 731 B
266 B 12ms
7ms Stylesheet
text/css 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdpagedeck_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:22:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2183
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 234
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 10:22:18 GMT

GET
H3-29 200 gwdgooglead_style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 44 B
72 B 14ms
7ms Stylesheet
text/css 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdgooglead_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 19:11:37 GMT
x-content-type-options: nosniff
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
age: 56824
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44
x-xss-protection: 0
expires: Tue, 25 May 2021 19:11:37 GMT

GET
H3-29 200 gwdimage_style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 281 B
190 B 17ms
11ms Stylesheet
text/css 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdimage_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 11:28:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84593
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 158
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 11:28:48 GMT

GET
H3-29 200 gwdtaparea_style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 157 B
147 B 17ms
10ms Stylesheet
text/css 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdtaparea_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 15:53:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68734
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 115
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 15:53:07 GMT

GET
H3-29 200 gwdattached_style.css
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 25 B
53 B 16ms
9ms Stylesheet
text/css 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdattached_style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 14:37:26 GMT
x-content-type-options: nosniff
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
age: 73275
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25
x-xss-protection: 0
expires: Tue, 25 May 2021 14:37:26 GMT

GET
H3-29 200 css
fonts.googleapis.com/ Frame 5B94 664 B
355 B 35ms
27ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:regular

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 25 May 2021 10:31:28 GMT
server: ESF
date: Tue, 25 May 2021 10:58:41 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 25 May 2021 10:58:41 GMT

GET
H3-29 200 googbase_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 163 B
159 B 31ms
25ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/googbase_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 11:09:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85757
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 11:09:24 GMT

GET
H3-29 200 gwd_webcomponents_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 17 KB
6 KB 30ms
24ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwd_webcomponents_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 08:11:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10052
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5637
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 08:11:09 GMT

GET
H3-29 200 gwdpage_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 3 KB
993 B 30ms
24ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdpage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 06:31:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16022
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 960
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 06:31:39 GMT

GET
H3-29 200 gwdpagedeck_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 6 KB
2 KB 25ms
19ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdpagedeck_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 13:24:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 77623
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2367
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 13:24:58 GMT

GET
H3-29 200 Enabler_01_240.js
s0.2mdn.net/879366/ Frame 5B94 104 KB
35 KB 23ms
17ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_240.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 05:57:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18056
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36216
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:31:20 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 05:57:45 GMT

GET
H3-29 200 gwdgooglead_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 14 KB
4 KB 24ms
18ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdgooglead_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 06:24:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16443
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4340
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 06:24:38 GMT

GET
H3-29 200 gwdimage_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 4 KB
1 KB 23ms
17ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdimage_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 16:49:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65328
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1448
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 16:49:53 GMT

GET
H3-29 200 gwdtaparea_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 2 KB
836 B 22ms
16ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdtaparea_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 14:53:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72341
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 803
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 14:53:00 GMT

GET
H3-29 200 gwd-events-support.1.0.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 5 KB
1 KB 31ms
26ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwd-events-support.1.0.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 06:35:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15790
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1215
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 06:35:31 GMT

GET
H3-29 200 gwdgpadataprovider_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 2 KB
997 B 30ms
25ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdgpadataprovider_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 16:01:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68220
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 963
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 16:01:41 GMT

GET
H3-29 200 gwdattached_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 420 B
274 B 30ms
25ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdattached_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 06:35:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15796
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 240
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 06:35:25 GMT

GET
H3-29 200 gwdtexthelper_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 6 KB
2 KB 29ms
24ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdtexthelper_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 06:35:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 15796
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2365
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 26 May 2021 06:35:25 GMT

GET
H3-29 200 gwddatabinder_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 5 KB
2 KB 28ms
24ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwddatabinder_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 14:53:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72339
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2108
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 14:53:02 GMT

GET
H3-29 200 gwdfontloader_min.js
s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/ Frame 5B94 4 KB
2 KB 28ms
23ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/gwdfontloader_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/ads/richmedia/studio/pv2/61183151/20200106024431876/index.html?e=69&leftOffset=0&topOffset=0&c=EMS8cIGYI7&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 24 May 2021 12:23:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81293
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1764
x-xss-protection: 0
last-modified: Mon, 06 Jan 2020 10:44:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 25 May 2021 12:23:48 GMT

GET
H2 200 0eWRs9v2owYuE6yDy88utlgh72O1yDgkHmBZb7_hHjI.js
pagead2.googlesyndication.com/bg/ Frame CACC 14 KB
6 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0eWRs9v2owYuE6yDy88utlgh72O1yDgkHmBZb7_hHjI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 08:39:44 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 09:08:00 GMT
server: sffe
age: 8337
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5773
x-xss-protection: 0
expires: Wed, 25 May 2022 08:39:44 GMT

GET dt
dt.adsafeprotected.com/ Frame 7011 0
0

GET
H3-29 200 img.jpg
s0.2mdn.net/10750551/1619025170727/Suewag_ServiceApp_MotivZ_300x250/ Frame 8E7B 47 KB
47 KB 32ms
8ms Image
image/jpeg 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1619025170727/Suewag_ServiceApp_MotivZ_300x250/img.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1619025170727/Suewag_ServiceApp_MotivZ_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1619025170727/Suewag_ServiceApp_MotivZ_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:06:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 21 Apr 2021 17:12:50 GMT
server: sffe
age: 3102
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48598
x-xss-protection: 0
expires: Wed, 26 May 2021 10:06:59 GMT

GET dt
dt.adsafeprotected.com/ Frame 6CA7 0
0

GET
H3-29 200 0eWRs9v2owYuE6yDy88utlgh72O1yDgkHmBZb7_hHjI.js
pagead2.googlesyndication.com/bg/ Frame 9A70 14 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0eWRs9v2owYuE6yDy88utlgh72O1yDgkHmBZb7_hHjI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 08:39:44 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Wed, 12 May 2021 09:08:00 GMT
server: sffe
age: 8337
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5773
x-xss-protection: 0
expires: Wed, 25 May 2022 08:39:44 GMT

GET
H3-29 200 bg.png
s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/ Frame 2943 55 KB
55 KB 16ms
11ms Image
image/png 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/bg.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/10750551/1618576853442/Suewag_ServiceApp_MotivS_300x250/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:05:30 GMT
x-content-type-options: nosniff
last-modified: Fri, 16 Apr 2021 12:40:53 GMT
server: sffe
age: 3191
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56396
x-xss-protection: 0
expires: Wed, 26 May 2021 10:05:30 GMT

GET

pixel
cm.g.doubleclick.net/ Frame 5736
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=445&google_gid=CAESEI7pr4D6OHF9R6-0qM_4UZY&google_cver=1&google_push=AQvitUJ-Z9Jz0-cbFPSAtUiIYQ0Sc2Bgfog1cm_rhuj0e_uG_XhZdtoqemFXvllsQQJ94BIkAolfY7ZIxnDb6MaaBXcSmk1...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitUJ-Z9Jz0-cbFPSAtUiIYQ0Sc2Bgfog1cm_rhuj0e_uG_XhZdtoqemFXvllsQQJ94BIkAolfY7ZIxnDb6MaaBXcSmk1fO-O7&google_hm=NjI0NTI2MzY...

0
0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 5736 0
114 B 17ms
14ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEIU53Nb9Xp-O8N0Iu99AV8c&google_cver=1&google_push=AQvitUJYZJ0x-zflvVoRepV1MEdeld0aFly5M3WXdpKXCt-ojkAQWyYsjRwq18lPVv8AttuTlnBF08cCpFMHjyY3Bs4CcnHN_7xF
Requested by: Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 25 May 2021 10:58:41 GMT
via: 1.1 google
alt-svc: clear

GET /
b1sync.zemanta.com/usersync/googleadx/ Frame 5736 0
0

GET

pixel
cm.g.doubleclick.net/ Frame 5736
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPlL7XLGodKNVWCMLqaHZLg&google_cver=1&google_push=AQvitUJPjYTaNpYhYJgVPQAAMwee0D-fTQ7hSUmwTGZ7xi_Y-kkBKavN6tDGALC5mjkbAeG7XdS...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1AzWEUxVUUtMTMtRTJHTQ==&google_push=AQvitUJPjYTaNpYhYJgVPQAAMwee0D-fTQ7hSUmwTGZ7xi_Y-kkBKavN6tDGALC5mjkbAeG7XdSXpOZwrKEja9qLFOVahlBMsq_L

0
0

GET sync
dsp.adkernel.com/ Frame 5736 0
0

GET

pixel
cm.g.doubleclick.net/ Frame 5736
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEO1yXjbgIV4_pXaJXgMX2DA&google_cver=1&google_push=AQvitUKiCFoxSA8H4wuU1YmloQal3l4kJXQ47N_oGmxJTPgSdayGRBkVg9rcDVjBcotpgdg4f3MLUmGJt1MF37vCZVDNNg...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEO1yXjbgIV4_pXaJXgMX2DA&google_cver=1&google_push=AQvitUKiCFoxSA8H4wuU1YmloQal3l4kJXQ47N_oGmxJTPgSdayGRBkVg9rcDVjBcotpgdg4f3MLUmGJt1MF37vC...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=6vBlPDGwRN2XUJ8Wq5-Zwg&google_push=AQvitUKiCFoxSA8H4wuU1YmloQal3l4kJXQ47N_oGmxJTPgSdayGRBkVg9rcDVjBcotpgdg4f3MLUmGJt1MF37v...

0
0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame 5736
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEJ98Zgs7EOIt6Kz3zKw7Ezg&google_cver=1&google_push=AQvitUKPihO13YuIlTyM1y3wcArDqOUzpbQrnVjIykbmGpfWGpa7jv4hhUI1OZqampINC8NPVPdY-8OMIugUXNKYu...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MDk3YWQ5OWYtNzIzYi00ZjliLWFiNGQtM2I0YTQwYmM4MDA5&google_push=AQvitUKPihO13YuIlTyM1y3wcArDqOUzpbQrnVjIykbmGpfWGpa7jv4hhUI1OZqa...

170 B
188 B

21ms
21ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MDk3YWQ5OWYtNzIzYi00ZjliLWFiNGQtM2I0YTQwYmM4MDA5&google_push=AQvitUKPihO13YuIlTyM1y3wcArDqOUzpbQrnVjIykbmGpfWGpa7jv4hhUI1OZqampINC8NPVPdY-8OMIugUXNKYue8kukjQQ4s5eg

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 25 May 2021 10:58:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MDk3YWQ5OWYtNzIzYi00ZjliLWFiNGQtM2I0YTQwYmM4MDA5&google_push=AQvitUKPihO13YuIlTyM1y3wcArDqOUzpbQrnVjIykbmGpfWGpa7jv4hhUI1OZqampINC8NPVPdY-8OMIugUXNKYue8kukjQQ4s5eg
date: Tue, 25 May 2021 10:58:41 GMT
content-length: 0

GET
H3-29 204 attr
cm.g.doubleclick.net/pixel/ Frame 5736 0
12 B 16ms
14ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IUd8xVuIf9vQTXRjaYFsqeolsR7PAYia0zEfpSNHDug51dgyDkf-Ts5mE0fyZ0FqQOuQOG0A

Requested by

Host: fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com
URL: https://fc7199084b88b6cf5f078f82277d42fa.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS