pastelink.net Open in urlscan Pro
2a01:7e00::f03c:91ff:fe39:1dbe Public Scan

Software

sffe /

Resource Hash

d99e408ba5c0441eeb135c8d610465d6d031fb0fbd53de7f16fdc71293023d3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1004 / 150 of 1000 / last-modified: 1633126070"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25720
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 03 Oct 2021 02:05:14 GMT

GET
H2 200 prebid-4.43.4.js Show response
cdn.adligature.com/prebid/ 444 KB
133 KB 41ms
41ms Script
application/javascript 2606:4700:3031::ac43:cab1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/prebid/prebid-4.43.4.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-4.9.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:cab1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4acafe4daf8d989eec849bdd8c025b2cda63bd1c3a91edaea56f948d04fd98a8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=msxAWQ==, md5=z5RQdZzuWEiAct3OzqDEfQ==
date: Sun, 03 Oct 2021 02:05:14 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 552
cf-polished: origSize=454478
x-guploader-uploadid: ADPycdsHGXXN69nJua3DlD2LFiGG1vjMtD8q33Fv7CRJj7Q_VrTWBiwGDwcuiC1IEmqKuhPsRHEpU-1Ks1HnropJOrX5o3CQkQ
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Tue, 24 Aug 2021 12:17:06 GMT
server: cloudflare
etag: W/"cf9450759cee58488072ddcecea0c47d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vh6YttcEDOF9OOGk7QORV9n7kT%2B4F6PoWtTluwioKD9v%2BUFb5Uvzx3NtCbBnutAfuwgALkF6Roe3P%2F1oGEO2WvVq5rHl%2BTbEPqrTsFjQYOJEqWwyJBCvkKKNHrfXeA5snJm2SP07bqkobuCsWjqx08E%3D"}],"group":"cf-nel","max_age":604800}
content-language: en
x-goog-generation: 1629807426503184
content-type: application/javascript
expires: Sun, 03 Oct 2021 02:01:38 GMT
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
x-goog-stored-content-length: 454478
cf-ray: 69829ab809bee8f3-MXP
cf-bgj: minify

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/ 346 KB
136 KB 61ms
13ms Script
text/javascript 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-TriQeni1Ls-Mdq_ssN2cUL5/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b0236d5c7c5a438a04858e85fe41d24cdcc0cf55a99a45cd2dc36bef08905980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pastelink.net/
Origin: https://pastelink.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 19:21:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 24238
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 138353
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 04:02:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="recaptcha"
expires: Sun, 02 Oct 2022 19:21:16 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 125 KB
49 KB 27ms
25ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a281559da52e7a8bc1b5387145d23d81b47e4f1d13f3d3a3568ba94b01277b0d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:14 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 49804
x-xss-protection: 0
expires: Sun, 03 Oct 2021 02:05:14 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 53ms
13ms Script
text/javascript 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 4697
date: Sun, 03 Oct 2021 00:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Sun, 03 Oct 2021 02:46:57 GMT

GET
H2 200 pubads_impl_2021092001.js Show response
securepubads.g.doubleclick.net/gpt/ 336 KB
118 KB 19ms
18ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1530727d7a9de276d5934149bfd08e535021a6596ace5c87fbad802580189d0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120245
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 08:37:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 03 Oct 2021 02:05:15 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 70 B
97 B 30ms
16ms XHR
application/json 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39c0b8be3e2bd4ecc61b4a789ac1e94d6a6812a15499181634db22e64fe7221c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 03 Oct 2021 02:05:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72
x-xss-protection: 0
expires: Sun, 03 Oct 2021 02:05:15 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
169 B 20ms
19ms Ping
text/plain 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oe9r0&_p=1762116109&sr=1600x1200&ul=en-us&cid=2026947553.1633226715&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3irkl&dt=8%20Examples%20Of%20Auto%20Locksmith%20Near%20Me%20-%20Pastelink.net&sid=1633226714&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pastelink.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:15 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
91 B 20ms
20ms XHR
text/plain 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1762116109&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3irkl&ul=en-us&de=UTF-8&dt=8%20Examples%20Of%20Auto%20Locksmith%20Near%20Me%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAAC~&jid=804618760&gjid=90766801&cid=2026947553.1633226715&tid=UA-55088947-2&_gid=1083830969.1633226715&_r=1&gtm=2wg9r055WHPWQ&z=1430529876

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
69 B 20ms
20ms XHR
text/plain 2a00:1450:4001:812::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&aip=1&a=1762116109&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3irkl&ul=en-us&de=UTF-8&dt=8%20Examples%20Of%20Auto%20Locksmith%20Near%20Me%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAAC~&jid=1446793569&gjid=594709086&cid=2026947553.1633226715&tid=UA-197326395-9&_gid=1083830969.1633226715&_r=1&_slc=1&z=140890099

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:15 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 346 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebd635d843d43673dd737988e3383b01614cfca991785e481a47e7bd6b8aea17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 64ms
22ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 03 Oct 2021 02:05:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 63ms
22ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 03 Oct 2021 02:05:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 93 KB
30 KB 838ms
838ms XHR
text/plain 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3166665392651961&correlator=4020145497501661&output=ldjh&impl=fifs&eid=31062993%2C44748553&vrg=2021092001&ptt=17&sc=1&sfv=1-0-38&ecs=20211003&iu_parts=22405481091%2Cpastelink.net%2CBottom_adhesion_banner%2CTop_leaderboard%2CInline_banner%2CSidebar_MPU&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5&prev_iu_szs=728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C160x600&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1633226715&dt=1633226715096&dlt=1633226714559&idt=494&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C246%2C281%2C281%2C281%2C281%2C1119&adys=1104%2C274%2C668%2C1083%2C1521%2C1867%2C355&adks=3402602959%2C2883060502%2C4220404771%2C4220404772%2C4220404773%2C4220404774%2C2108190548&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fpastelink.net%2F3irkl&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1%7C797x237%7C757x90%7C757x90%7C757x90%7C757x90%7C197x652&msz=728x-1%7C797x-1%7C728x-1%7C728x-1%7C728x-1%7C728x-1%7C160x-1&ga_vid=2026947553.1633226715&ga_sid=1633226715&ga_hid=1762116109&ga_fc=false&fws=516%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&btvi=0%7C0%7C0%7C0%7C1%7C2%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

829f6331b06c88c1a2d4df8d258b896eb6c3ad49437fa677292c9baf0ac29b15

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30209
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 0129 6 KB
4 KB 75ms
23ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 03 Oct 2021 02:05:15 GMT
expires: Mon, 03 Oct 2022 02:05:15 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 59AC 6 KB
3 KB 317ms
15ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 03 Oct 2021 02:05:15 GMT
expires: Mon, 03 Oct 2022 02:05:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C2A8 6 KB
3 KB 317ms
18ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 03 Oct 2021 02:05:15 GMT
expires: Mon, 03 Oct 2022 02:05:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 801E 6 KB
3 KB 315ms
19ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 03 Oct 2021 02:05:15 GMT
expires: Mon, 03 Oct 2022 02:05:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame DF25 6 KB
3 KB 302ms
19ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 03 Oct 2021 02:05:15 GMT
expires: Mon, 03 Oct 2022 02:05:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2D17 6 KB
3 KB 297ms
17ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 03 Oct 2021 02:05:15 GMT
expires: Mon, 03 Oct 2022 02:05:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7073 6 KB
3 KB 295ms
17ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 03 Oct 2021 02:05:15 GMT
expires: Mon, 03 Oct 2022 02:05:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C806 6 KB
3 KB 291ms
16ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 03 Oct 2021 02:05:15 GMT
expires: Mon, 03 Oct 2022 02:05:15 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 63ms
26ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021092001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36423f37d70e3b54ace6f0fb05beabf48cf4bcf3129751e58658e7f2b8dd313d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8561
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 62ms
25ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021092001.js?31062993

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame E09B 12 KB
5 KB 14ms
14ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Sat, 02 Oct 2021 22:30:04 GMT
expires: Sun, 02 Oct 2022 22:30:04 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 12912
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 22B3 783 B
945 B 26ms
26ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

015f99b9dede545863ef8c202cd5e1a8cab5dfae8574e49f2af48b0067947707

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-n844FxMoCDm031H5JuRJAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sun, 03 Oct 2021 02:05:16 GMT
date: Sun, 03 Oct 2021 02:05:16 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-n844FxMoCDm031H5JuRJAQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 514
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js Show response
pagead2.googlesyndication.com/bg/ Frame E09B 35 KB
14 KB 49ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9d3fd1f2686390c9a4a63870971c6b933745815caa2d262ae198d42c12a8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:14:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13373
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 15:14:50 GMT

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 22B3 0
0 59ms
39ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021092001&jk=3166665392651961&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 2E26 624 B
559 B 72ms
30ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMY8IbfYjAB&v=APEucNUBEl_kb1TOIO-VXwRfecDgOyG3812hWulePfjoyU1NCtZ67WNm9cF77higEhmfuNZYDsTo97DlJWycKiL0-5BoOmeVhE0ZShf2sCwhjD7I1ZDTfdGczLvrzeUC2dtQpV7rXjw6d1Hsh70i2CqpGQtRfGsbqnOPaZrvGWK_BoSUvAYtaZo

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CPDkLxDD7WMY8IbfYjAB&v=APEucNUBEl_kb1TOIO-VXwRfecDgOyG3812hWulePfjoyU1NCtZ67WNm9cF77higEhmfuNZYDsTo97DlJWycKiL0-5BoOmeVhE0ZShf2sCwhjD7I1ZDTfdGczLvrzeUC2dtQpV7rXjw6d1Hsh70i2CqpGQtRfGsbqnOPaZrvGWK_BoSUvAYtaZo
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 03 Oct 2021 02:05:16 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUki5FJ6lzCTp-X6w_jEAxxzbfv8NFfRJ1EcnqLkDSRJimpjuZzx4lMim2kK; expires=Fri, 28-Oct-2022 02:05:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 59AC 69 KB
28 KB 107ms
65ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BNP9sMS7yJI31UZrenyhl3WZh4l_DeIUROmPYVU2sPNqm9Nu5wkctD4taPKc0OyDBJWoOQvr5mYNVzaE-CbLlWlYREqequLJ00yIp01iqUXx52cgwCoJ_drhIHIY_3vxj0ErQjrqqg5wzphs00UiUb2XOO3A&dbm_d=AKAmf-BwLqaxgm_Go0yibsTcK5vXSP9cqbCoGW3I3ISKRtMJvsGgqiPkva71dHUiGI0ZxX3VrW7AcReshbC2lIUsEaFHve99yCz6_AKAE3vifsb4abyAdDTh3NXxH4bMzjgzGuo2ZTlTLAatqV3esUgCnLjRorPF2wTFLeEVX9KoZ8CbQwPZ7hr-mWjRXp06yrMzY9RbBP3IW9sqUyw82TG5ClzL5zwTjPzPSVDLj2i25aGPT8syb_2P6JxdgYf0b0jhAh44M1ogTrRkX0I67agyRyffhGSByLJ3oiRIphaEECOFKKbAX8iPrFVl0uNq5hmFCI8-rAz3sP54kzY0vjlN9O68ggWo_eMvduzqPKBJ12VDpHrWb9NtUywdsm-7TwkNq8hNAV85WVaVksrAbf7V183I3Noo-0FiqvHXon-5neF0xXYYY1mgAElFqxETKfrUAtz_l-NICKoAn4DRM-RhnkCFxRBXNIOtcnbY33CJwJZqFBduG5rATK867WjoIJ_m-QyyaH3gKEPhz1o47rrVbDITHc__nexoSv5If8ImwGYFIbmIeRRa5Ad2XfyV1J7JcAjms0wfCE42ohKq3kNkOw1jWrAdoat0HKviof33smZAJLgJODbsPIXf7wclus4Bsa03cfkNzevHCvLByazqy4_i8YJT3xgNxoUoa3FB7deQJE7rSxJ9lpTLJXc224QDy5uFkO0eG7M5AGLw3yWO8_CxvCrn4sXxTDzM9K6SoY_KKPWK4eHJS0V9SjOVlNSOzN0BiZxHaV9Sc9eUIskjiEPKdLvtWYXgUXcxj-OtDVvEqP6ykHWishsbEB5C7FhtbSY5wL2Ke7rve4qTSgqLF_Dl-fKBtgkTnNvOBKqxKM02ZItX2LMbY8PocRpRVl9M486gRY_iOE1M_iK54iWXDdGUtpfiW0itzOgUeDr4DyqlW-RUki1Nggluj1f781UVtc_iX8A_gcFbfdwg920_XQjMQ3OSSkjfzEFzygxG7l9dIJjt_8xcJ33fXxKslZKwPmN2LtEibf66VtjAoS48xATsZiVJA1M1CJ9KN7AyRm2IJzdwpf3sRxLEPFCMM3lzM0G0qkZznPQqU75I9p21YrCZkOy0vLyLqY7zUtJY9N5HOzgMJ5rKvEqV0XrHeLWUfr0imvJHvRpp-vQeb2qooFE14TlcHTTSuI0vQ8sXX8wZHOha6zp38zZbQSXzh8t2B9Y8EmUVp4-1GsS25BDRBxok3XDHD5BJ3VGeOuTn_4-hzSVcJ-1d0jX66gpGpm8ge004kWjp9BtBOQjukrTWU8N52ey_9sP2W7rbZn-big1brYy1REeqERccPUq6mjUiqQCxXBi0Wx-dOHJv19HHb_gsV1wYvOdjfRTx_IxIvsePNl2rrpI13Jeuh_HtDCEkpW-eYtgYjZ-hr61AV_WG93H5BPszNXL-VAkwv5fM6oGlY2wGKASbNcAd__-X_fakKxBLA0joY4JJOfFxBl9Glciy6mupo0xoeGuWWVjrORwOHIau2EaYLO5DXbKBJ5icA_2RfeP3R-TqwPdpRTk0e7Fut6B7rnFC0n8U54q7Vr9zn6fnrATA3u6hinexPvXWeClLVLYkelSfpHX79x0aQM2TNOQEdN_79Fd3NDMBe5BqgmxPnnwu4N1YHjoYMtIVbG6rw5NKm3ukMwfM-ZHc97VPFKX5p-LDhgjMWst638QKEL4sd8pkgocJLgVp45ln01cJ4kIZI4PEhyhAIrFNkyKB89nTW-9S8f9adUV4o_acQf9i0BSHikd2eRgeJwf-YU0ZRypOb7cCI28zAIhMlYml5o_lu-0acBN_WC2kIBzS3VqurfnewFcVrzQFu65_yJDWYPUBASQGrmCLJqxqV_mcpeFkuSs_sS62RTnsDtsAHWMOktbVeb8mvVUR71DVCHAH29LP4Kaoss7PMWYT5_ALE8peTyS4LEdVkj3wRvKoTx6hT2akxwuSObj5jhw9JQ5RsmHStndX1bcsZSAT-0_AQWVxPhMF8EzSV6tZu55C2RBpCkZnxam_w3k-9gtE4UOTdoSUWfVEPXZdqki8tbwWFwN9XDdhOtEXQ8ldPI-AC5NkpBsY6wJgNbCar_dM_eywR71ydZPeswHK8IEGDBBVlNDK0OY93a5hWGiYkzzfW1qWEv-dnjHAgDZGTTqxAjf2ntHSpGYZk1io4l6jEQW1gTLkVI6AXJzuZDYeqKLHVCNgMn9cvrdBriF1NwooSYdeezfLiy1js3FtV9GVRehewd35P5nMYNfcIpgypdecVBuaR3QiSYyRJg0yrmdWQPKUS8K3psaBilvM5SiuOZnXG5Yx5pamu_4hHQO7dlGNLFqjdTHmT4kfTPr2RYfc6BJU7-zfuJAUduKNvj0YRzsrrV52dgczdN0bi9hfFxQWttAuU3M-RLv5kbbZhgksOvPjoSrC1CasI8nqC2c_nC5bdRZnAmnqB8KqIdWwwIglbeCMjG_nNwKYrhSjLjKjHBDWi_MASwNkaGv0QzX90glOcvSBSUuDZ_c6Pc3-pByVILsnxgMk4CS_P_KaSP5FmyhgGFyXsp0GzCXVIdg1G8crgUmyiyVKyO7slCYukBhFWWxgGPXbNDhnI2zUrAs3AOY07HhsV9Bw8tBi1fOhil-a2gwtq94FvPEmvO-ZRES2zhBGZ5V96tQtaflRbtOrl-3C7-f-MZs2Or5M0STlHKXL-kYb4Iuu5w51RwUEKQ-q0axF58rVW37U_YZ2u2vEDiWJjSnbELz23BAtiZn6EV_-v0xGpoNiVaHfArxeT1EGMIW9xM7baP8Uyol5MenGCeacD88etynjWFJEMeZVbJqySCXu9fRw_cFi7ucO7oW6wjrboUhK6SwXk8-Smbiyzlk819avOHENpl-0qbDiB554UJ5HGCELkZDI3b8U9OwkeGZWvsKpth4H8RguYe9wTzdZao8Ju5fIFAwORqKe0DwFMTMirDGgfVkZBccdLEHBhuOd5Rkh6nSlZH-aZVzVwztoDQeoNrnA3P2GCURl0OYwvuih5g&cid=CAASFeRoV31F2LaeJBLd-qD1Pn8mPKQJkQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd28e68d5e665dfd6f4f58437c27eec36a7f73368cb38334d64fb93cd6fae102

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28350
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 59AC 42 B
173 B 26ms
24ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DUABKfS1Ho6VtWNxj15H_jgqTSZG4dE_c296ZqwiGMxJI5j6XAeMXaJ4epj9cT_8FmTwNp0HiMa8e73QB9T1jyLIYEup0EXllFw_8LFQx-IqrOSK0

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 59AC 3 KB
1 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1005
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:48:31 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 59AC 122 KB
37 KB 55ms
39ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 59AC 14 KB
6 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:11:50 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 57E7 624 B
560 B 70ms
31ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY6s3FlQEwAQ&v=APEucNVghz4vc4ctvn_Y53JWWyGLrHVBGQ9pvFn0cA3NBhL6P37z8a2IVptxnJ_4n2n8VL71ahIkk9ypmmKxEo89gX4CJ-0romSE1Tpbm84eQt-jbpWByva6X3tx4Lu8ghgZwCb2igf3388qL53y2OSr89sG8C-INUnb5zEmeF30zQm9-LI7ZKU

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsY6s3FlQEwAQ&v=APEucNVghz4vc4ctvn_Y53JWWyGLrHVBGQ9pvFn0cA3NBhL6P37z8a2IVptxnJ_4n2n8VL71ahIkk9ypmmKxEo89gX4CJ-0romSE1Tpbm84eQt-jbpWByva6X3tx4Lu8ghgZwCb2igf3388qL53y2OSr89sG8C-INUnb5zEmeF30zQm9-LI7ZKU
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 03 Oct 2021 02:05:16 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlCzsy8kuOXJiXN0_xICrUCVVW19doxTxmzy6nOSSEOdOtrFxpT7rE6r8SW; expires=Fri, 28-Oct-2022 02:05:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C806 25 KB
13 KB 93ms
53ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DL2ywu61KANXxIlU7LwrEqn7QsuH2csM_FziUFQU4n5eC7KPiZfysmfvVoVGvAYTJRYRYLanVG4766VgL5qNrzLjmB4BS3Vwtcn35swb6OA48kfldXMmBSUqtiB9G2fkgTD8lrVdgwNnEYbeF63DAFYVCe4Q&cry=1&dbm_d=AKAmf-A8w0X_gYNz8Bu_QqNZ149gdGk6dC69D6729uH0FxNZ7EguDxXnIghEni1Rt4s-vtQErsdcd4oIukgdTj29ZexoDubDLNPqO0mTk4SsrZsymM00yqM2ck7uPJWKvFQT-oz1dSJ0VK7POheUf_v1puNCstDs03_nlvGGg7oDHW6FMLM5f5P4yjH7zg7G0a03ofsvDjnfPk4UywqBXn6S7bf5Z-A28zKy5Bs3vHpEM2h2huBkvQlCbXyShXrueRbbgemm3pC9ibjq_XfmuAGhtSttsOPru0r0E4O_QfEUyWflX5GlkrEq3EtCdGq2VlGt-F0yeQQ_2htIsufpYGDHr_EU2wlYVoqKgfbd26Ha7pUCjvn6_tIwPGUEe25kEAPvRx44JOjSeiKPhbSQZqSvWZz5REpLtWtHlUI9h6wLVyy8kDHU9PoI5QmQkaLZ0vFiAXazlhOpkEhag5VqyXijpPs5hbEc21YmONMXqSFR5FvR6std1HaNHrtUuV_irO1N98bJP_NV3XJLgsX3JndLpma4RJGRtR03FVq_EXASfdjFZUNNvldtQ76HNZVF_dA6wl3h2OSRNS_1OkuFu7Kg07yCOiVxRxOWlwAJGaWwIkxjs9M5sBIqKIEMxMxRvGimaOnv_OSD-6AY0g8tWM3LnmVjDdkhEUMVV8pzj1q28y24zPJ862QwP1QsJNn1_FMrDhfAA4DgLDZ3Icp9Hl4i6YF_-wnL9o108J94hozR4cJgSs0qk8iy4URlTfPdjSOD8xZACuV-9_IguRfqw0BUHeF_j5Bp7GbzmnR7Vap72c4wLjVsDR72MI3BSu2faKzIR7bZEMaKuIzMK3kZRxQYtyXKHMSVXCYclH2wRwAfmwOfzlLG10VXecYcuyr77XO1hzrCXU1pSscSYJwOhKCQDgFcAO-2_xA-NpQ1ei8KnXHNOFS-4TjkBaBWD0RgKiFHHjpkpnXMOXkmVLmk7ur0EeUdJ50LES2Izcx0_Li-JYwEhewk5DVZI56OI3fhGshZyy9zTtGSNnS7Vjsx5Qoay6xhydoyuqcYS59AxTYljFlun_CwbYirsrjhIE2NtmigYqlXcPpxxhDdymtHhAA0UQ1NGSegopW7cHU9AoAQq6IubRTLwo3tlT7MbV3jDPoXHhFB_eklMBNPMk-9J7CgGDimkTmqnLRr5-4Qy8G-ErU9k3ATVZxwgFBrsArwWYdAqbdnj0KJ37OX_NbJN1njLPB9XJXVv0qTJImS7Mr7ziDDwqLyUfzThrmCLNzQnezWiEyaQfDc_ZKyw0z5_QChT7l_JJXds2_ybbCgbfunsInZQCzDzXryiQwoFgnHZ52WBs1UMs9stIr6-yz7KsByaVJlI3uOZLwlKi3UQTZfFc-kddqludhZGxlkHfc_eM4otce527wKSuyZHUG9rJ9b-_vTugbmZJfMZhHyrySH2cidL9OOEFXOzBiZhyAf4twtGpcL_ax_IAKUbWf-E0Ln-lHyFhp68RFBohEFttXYSb-21Lopa2oNFW_mteO8xbYKtCSL8WbE_r7s6z6pfCx_4OqToNioChkrnj8laVZQlmbC96YCxCy3DPWAqPdb2gx7SVU61fIa-aaif9ID56wn5m_5FGVNx_Mx98wQWsn0GVsLTospCzBPqRH92GDdFcqVWbcQo_kUmuFkj9bMpm1Z_J3lMn-DbVbNJ-VPgCxc5A2Gspob-NRg-W_m7AJrTPmM4ovlgmA_XFeXeCuc7BdBpd94JRQG7yS7vTlWCeP0HXYqIS9hILrWNBx8Ejt4vokTkc67yQyQPcWvJqxze1PVJ4IgHA2gIIA_IOmr4vS5bBtbK9lxxpraYZNiMZQxhE3zzThIqbBL0qgMGxoeSuXqJhvbyM_GKhuzmli00457RYJmT-7MYKZqDFJtBEuq7bJKk6wCpr35yNYNdZ7ykWgZk1B1X7r_mz6e3S7mQyoQveZ7Y7DQZv7kRzS_V3pyexANelqC8OUqXkgQLdVPhOfaGvTT9N-DVEPUny08ZqZYrhGOvO64d9sb05g7PIJeeqe4CstvDKqfqAu7BW4zkG_J53psIN-h5P4-6X8nQJiQk6-msOqEBzfgu2_TYlx9YEZLa1n1vhZ7srVCuf7UwqTWBQvxgXyOsV8H280gsoDhDfe5a-PRWtFVj5MeaY0PGT_fNi7qV3I7hs1p-rwMmbFeEfDZxTWTrek0ieTtz2gXTy3LsEnhpDmGOnezdIlam4LgkzpPQufgwrEmghqLc1GxQqUdi5Df1bBGRe88sN7HANtvqY8XNZ7YMxAkbUnaGLhShvvYB1YcYQJHG-WDKybH71S2vV3-iArPJOKSweySH3p1GzzcS86Hog97o5FkCZ5zMTOXfYF5uMhEh28smjyHQ11AEKb7-M-5gn1WVwh3gGd19Pb74ptI8-Q-Ptwdnebp_Xaa0CCJZvhVENkl74ivdxijKq2p0kOid1X8e5B6yRy_2TSFc5m3qIVQDve4apeHHHY6ip9FXrJtPwdvHOCsBsAfPDKrQhrCjwT1dmCesX7kD4r1Us7pDmWuEkbI5OHBdUMiOkU-NVBp-a9Ln2KjUVGcOsAv-jYrRx3Nx-ToiktGMcqe4zswW217mc_BTIps5Po_RQ8qizT0njmHwv4m7NguNbpsVMPUK2FcghEt-ZpJ6RAR-P7dcBm9NeOlJ8H75idWsdV1P5CH0_c0ANnTROjd_0mjZcZuARftJPh1a7Px5ovSVVvwLHQfC1jw9SgaICCKAAC8T6f_la18elk44wps0bOxRNHhweARpBqrRk45pHEi3-Uy5GHqJRxs6rnAR3Iq5WV3Sx2Z8BqlgccQpkW2EolCzHsz8pAUuXEem2wYadPxO3H1YEwOBedx5c2CCg4o89sUoxznw90G1sjHaVoCzZOFx0Ib3OjLWWXNJiv_8XJW5V3WwVqI3YUQB5r3n4dtWQZqrL_if60TBBz_DDIFTslGM0j-iABl8WOvomckg0Ra3fHYKV66t9rQO0n6Lh-gP_J7OkGc_Vr05syySDjoNte53QH10IVdkP0Gyilg4JqL8c0Mj4Izv1NT_k07x0MEKP0Ualk-nsxwQ6-OgorestL5TA&cid=CAASFeRoVvJMa5i0-hq4TfPoCUKLrvXMTg&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6e4604499ff1a0cef17e531ec336586c6fadbe0a844f0fb3489691d3a7da810b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13094
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C806 42 B
107 B 24ms
21ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AjWXGg_-HuX1rPGyScrhnf-JdUXt5tJQGc0vQl6NR6eY408_NNTW8jGcF6mgEaYhWg5kOwzs8O2P0mz3h-XCjq8NVQz3VAIV9AyyGuWFgiyVghUNI

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame C806 3 KB
1 KB 17ms
14ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1005
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:48:31 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C806 122 KB
37 KB 53ms
40ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame C806 14 KB
6 KB 15ms
12ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:11:50 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame C806 0
0 24ms
22ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRv7tnq7q75kDplBjbkVoYm2Qwfosi9h1rEm1aJqIKs9RaeDwIxLpNT63YG8bS7ZikCnf_1Nq5dpVwbxgdhUU5p3NE0AA
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 304A 624 B
558 B 65ms
29ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWJThx1B0qc6JJNVvsPOBQw0ICF416JrXF5W3AqKqRevseCLtYojeIuS0GBO4MwRZK6VcfBbsbixhgzLcLloIVutHnedA4j2SfRabqxiO2G92GDmtrjI71hIx8fFxivykJIJ4BYN-skKy0C9f9S6U2R3rKPY_B7S3SEXH-pzAYRUajj-KA

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWJThx1B0qc6JJNVvsPOBQw0ICF416JrXF5W3AqKqRevseCLtYojeIuS0GBO4MwRZK6VcfBbsbixhgzLcLloIVutHnedA4j2SfRabqxiO2G92GDmtrjI71hIx8fFxivykJIJ4BYN-skKy0C9f9S6U2R3rKPY_B7S3SEXH-pzAYRUajj-KA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 03 Oct 2021 02:05:16 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmGVipMrGTJT3dKaOXMn6rbiQJaeSucHqy3Kg6XlgTYC9b19tSi_5AqNhFR; expires=Fri, 28-Oct-2022 02:05:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2D17 24 KB
13 KB 92ms
55ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DqD9bwHkIY6fqYeUcMHjyqoeM0lYz94a2LxDAO5cEcJv0FNwS1-7ABJniPZ3hUvw2SxcO7h40dYFxpTGlDPwwGI_v3AuZBr1Y-DqHbtjvafjHsSFbjkYADVrw7U2oBgwfQ1nLKrN4qMC_UJRcOkpK4tS885A&cry=1&dbm_d=AKAmf-D2fdgBv1jK0y0Prkk7umxtokS1KfVPzUu-rHY-35YK0gSF6jvl54fHxR_A3Ic__Ru2Op5iYj6VFFUobXoglYI3LJ51lPf1lhuc6srnCYvceL8jfpihi6Fb49HFb8ioLGMqdKFgdh4kjBi1ByxjANp4xuUHDfJAFD6ebttn_GDJuF8zeu0wLp6WdJ0dujEr7ZB93b9nz9YaY0hOn9B5y3M25tIrKR6zePEVakC8gbD_JLpL0ucq7WbOl81iJ1Z_AGTVOe6npYGOx4kjUHJcZjeJUcuVPKUvRBgUpGsSD83_jy0lGLk6QnyT1iGQL44laG--Gp6bzglIYB02iCPzvLDfMVUei-fF4juYIgjLz9CghJF8UNM0licC0dVRY7uqYDLwpBrGL23weeXr80BUz7FqaaPmk_peHzkgzwz2gL2_C3OitWkAF5W5ow2Fe3r7UVSufcmsGmdX7O7lFcN0oui2zZbHnhTju2vBgI1HZC7HMfcKCyCp3n93wWu_s68IxsN9wxs3mEQGJR4C0Y3VUxIlZ2FjjNd8Jqi0J0gErCTvFA7vBhUuC0o0tU3xL5VxkI_of_o31osPzlsZcDrakQTxyiOCLH-P_4nSQghgiToA2BgZe4XhEECZZrd2XWAG892jXOdStaqXYLZ5Epk6wjuYNoWSydemi_pd48BUu7lJRnEOFw-dASIAEXxDiDIik521pten0na2_yAefueXpRYi7eny_qUMCcGp1xv9Hg4OA1rydtBCgvump3VdAjfYTCbUSrosz3ZTHrveWiR-5AfP7n-saMVNEKb6nwtxaGrrvtvwoSbcxbyj2rxHQagnKQ6ouz42K64aHa2cWMSZ9cDuSOy6nxvp4L2diKm3M1qy_9qdAPEshR8jyJve9LT0ET-S85-PXa52wNWulwGb1RV4lGLaeXi3mIAn9mcWx6aOASlfmpF06dB1vnN5vxVxwOK4GNewmXFU2gFfhDThQCkf2SsAmFTHK7PruKTHc7oFqPmt-_Gh2R2r5a5jY4xDIw6a-Grsg9GJYsWxPc5cURnNJyJcU8EGCWhKJQpwLWlJMok-UZ5OTfj9OeAh34OgjJ-M0MkL19DRgwmidReVNZi0jZsN0np5u34RO7BRzxXR1IKI2DCiCSZJb--mjF2sKGXnXOHizScgVTX2ATw773sl2VT24XpvhfYu9TcqnONjAGbvm0K7SaQ_7VXXnvr2q-9inbjnCq_ycZZWHb8PVgATFyvPzZ2EBTcAqcSIlttb1SynFv6AG5kdZf1UDrRWSQiwzgxFI8Q0Uhw_pczVDIQbWGh0Sh3NrfcBagb-LARSHv4dTp-yXV6yOHJVy_L7Kfx0YrPogP1K9SRv0lGxwXBooio_ifQCLS9C8wcVrpsbMsphY9fHiRNvLr05NZCZBcMBZb31uNWENj-p1SzTPr8mqdhsbJaq0o4OhvNpdVGP9JHcj5ySeFOXg5bIQDQAiF4F6K1dK_jgfQjEb15mkLZhVR6BPkgQDNM3ZQ_HedM9X04-pznxn8HSgxy1P8elEXRh2gHs0a5Blxd7t8jVxpzvD8npRYE5yYgpGAW_ecy6b-Bs8dyFP1TeblC-3eFp-Fep_o799rFbd30ywnB0KJi6EVpo5-eD_dz1XgN9n2fuq__Pdk1iC229jtHE0zPUUub2IdwD3ZP-QJdjlUzT6U14Qrcy_5rIAMRV_TRmwfRtht_R-E-jLdTSxSfFPAagYxviS_Ajx-bO3kSzRm57BRw3T0O48xkT_FIy02XghWFdIiTztzb6VGXYN8rXgdG-DybPw73FAA5Gox9dyTJXQWURrEESBHFsKJ55-WFycXlnyEr2--vZKfZ4g6pP9lud9TgUkpTOpW5pbWleyNHAAEJl9-WOrzT9oOYvG2Sysz1j6zvWIMR5EYed20xaMuJD6n2JtbWhRAKiX0VTcrMK4UpmNjn_71CYzRSecVf6DnP21r5cDhgHV-Jz9jJahqja0WPgOVWHDmYeZ_yY5_7HkkOdn-Q_phkztq1CzorS4_DO4C2v2x8MkuynLX3uWEKNxmNceFYut33WBrv5T-b9QR1nXlQnR_aBjF2HZ88P7Kupdjrz3GR35r6yqdvm9bIsdvx3hjxg4blBl_q9nk464ICDi2kbKyInLm4INWnwXrOXLnobEoDf7Y5ynoPBu5bCxSVkstb4tpEkyZcF1UkMtPDfAERUUYidnt6AoeIda_-X_1TBsEP1moYU5uXNV3wxqmsdQtdSuLTXtCKPaohswb8zXMgXgztfxP9XmBgWByUNui_uTWdoUzrkTPFxmSaGFfxeJoSyICztpCcg26l_6L5QAamMAJgnPIHftz4iXRWe81Mj-96_UxWjzMrU1-nWWdkv4C0c2MFtdrqxSq1DZOzwM0fU7pbS1QJMlg_e30ntGa684bZTdAN0MlqDN4WTBfAwgBpXmSakyd2YbFhe4V6b7cCyfGdO2PbKoY3ojvjOl0gQI9ndiGH8BD5_zGugi0_cPiF6NyA1uspo6K-l5NhRXMMDWhlCZlzlyKL7pKqV56L5vk69Zr68kLNRWRn6MYRZW1rMV1TBOBEx7VdGDJ48xbL4PuUuN6L7vFUMuKGLKG_tyiw5yORdDB5UhYmUmyiOThRQdnjP1Kf2kUOuuwNaJw0xvuWDhPuI6x-Sh0ZnUG8CNcGOI-Bh6UzWtycLSrxI2YOi1f9mg-m6xdWOE1ihLJqqD3o5mikzgSRYuc_yMSIt4SYqsB6E69a3CK0QxKOSC1CeT7Uccg5vX6YHLcEF0ZLa1wNNuZNvhQIJJROFR5xbttToMSFiSlHnc0n32GUB9_oA5NOvn_BO9pMvuP-QEKZp_U-AOiC7avBjCi_5c7ZPQ9J9wr-bakZ1VZYaVF9XGGUqM1-pOSEBDCbMs96xixwXbBnSoJBLsVcAQNCjANPzTCUA3wP6vSyt48SGBRypwDlr4VF1fwfI29X5dMpR-_YvgkRrGqHtumkX1WlE0mwINIGZtgqhYztipOuneI6PvqwvrdaNuhysFVYVjrY285ArViLQRuyM4NVcwCfaKvp7UUu5CRHp1FHYI-fZRo43A2teE-0My3x5f_Pd0JonmPUry4p9zZM_Zjb293GwWQx3-q-j53Xj3VFdPSTPOzhXp6KhMFSRmH2a5gxzpUylQiIpw9qV2ba7zuDf4HnKs-lKzW90-Qg6YgnwdYiNzj4aUg9G&cid=CAASFeRoWgq4v4Rs6wL-ObHvsNp8wFsDPw&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

13e8db625413645a4b7318ade1df3d5a8bdac62ab3235033db752a1511254374

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12887
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2D17 42 B
107 B 24ms
21ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DhGNOhWv9j3Ir9LAiUGCigCpUfR9Q1DyTePfFvB8gSwDzRSlpciTMTl_ZPrLeZJGiBlbznGMtgVnsSjW29gRLPTQGpufXGcG7qrKMDE4BmM_UKCBs

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 2D17 3 KB
1 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1005
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:48:31 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2D17 122 KB
37 KB 30ms
19ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 2D17 14 KB
6 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:11:50 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 2D17 0
0 23ms
21ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRB8Y3g-sC1kgJUjwCtt1fTeWHUKdRXkoeTCLkL-3THDgrr7xb38VVyC8BKJ5itDeQQWGUqxUuZUaOScCAdOoXTzb0DOw
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame BA94 624 B
558 B 73ms
39ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWfmFSAll_F0op5-ngUO7o-4_ODvuyduOJDmsmUJJLy93Ao3_rxCWNyCT9rPbsuzpSqdxlCqrN3lz5eY5Nw05NV-AA6Uia6cjv2u1OAJXaP0EC6ZmYFPsPqWbmLd4g46iuBHLbdBsHwfL5Rfmxre2CcJSNoxcUp4HFhKZsc-3pIlzMyLAI

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWfmFSAll_F0op5-ngUO7o-4_ODvuyduOJDmsmUJJLy93Ao3_rxCWNyCT9rPbsuzpSqdxlCqrN3lz5eY5Nw05NV-AA6Uia6cjv2u1OAJXaP0EC6ZmYFPsPqWbmLd4g46iuBHLbdBsHwfL5Rfmxre2CcJSNoxcUp4HFhKZsc-3pIlzMyLAI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 03 Oct 2021 02:05:16 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmfDkdxomjPy0iclCGNHn6I12tB_ku6r-7oolIdwDpPuLRkzgRHgdP0XiCT; expires=Fri, 28-Oct-2022 02:05:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7073 24 KB
13 KB 95ms
60ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ddz0uB5PfhH36k9pDma1otKQhH0O4j5Vq-ml60sIzn5RTF2v-XxajAisDBcjlKT3Fm9RCVF2MX_pVFfJJaiC4fj1tEgjoD2rjoH_v2VbMW59Rx4tUpd4inDm3-Lf0yi7ExkFj5FkQqW1ZHs_67C4n3f1guoQ&cry=1&dbm_d=AKAmf-DmaxHjMuy2qgSydJmTWWx4AiLaTDclQP8XXyN-K8nzYx0c6YZKue-96zDmPG-2gj_4jed-WNAIBZP8mbOfDoBQsfR8Nff4CqF9l8Wx1AjbIK4JWmVCQcMtuGLUm0GTEuU2KDRhFnHGf1mKbEnEeZm9nG5cdiH-tnyzWFmZpQF5e2jsnBnSWXcGMkQyvKTCRlFVfq48t8YSBkjeKN4yHaNOa7DFA8MvZBsPnjcTg4OSGW8esFtrSQIm-u_dTiEArNr8Gi5TjwgGrCcYsTpZQ00kIS-aF_MSt5iVmHSf3vLZJoAY5hcGrDuWNpJL7eYyBYhmwJy1ZeUrpYPhvkVjnyBvr6QFDWKe5va0SjhrvC2dLtoZ9rgx9PgMnh64gkxXbgxPwLWViWTUAMjJXbce4TKsK5fK8HWIl4GDLspxiG3B_pYgv_-Gr6D_MFmXH7P0XCK_g8iFCj-SGFfHnFCA10uS17bsrIRZfSgnKnMlFUOJIOjPr9p4SH4eAjpismgniMJXcwlBa8RbvtzFRRqglRx0Vkhd8cxapDv5PIP5lSJQ-E3ebBjqkf_IXC2HBlzi8gbC0lbUKMFyXZOwH6JZx41zyVJ-Mvo7wk_ksooutrEaVnNiH108Aj1yPG5XEiH_V-iFFmEcQ1JSySc8rDgM7Qc76FDFiOTUaPsB_sSoXZper6f3C3Xsc_ywT7yXNWsb4rxNyFAxOGl7R-Y-vNt4eE7dOeoBToqb13GBd_UBX9U0qmzmnsj6KNTkGRoi6o-Euanhy4dIK3c7fPQAbdD2m9m6nsoxUUVwhcQXqqW1K7JwOUQ8YVqPQ7Wvkf1mNjT5YEgs-HySVADVj4CCYLdgZl4VSQeidTwCE8Xrr6RMfZ35KplY1DXzRpXyI5w-nJ55al7HOFfwy9AgCLAZ00CGaRtJNrLLyMa1tqvj-kvrT7CMDXFFuqy79yd08XHsaVVvLmpewGPm_INQN2bpMmXnN0ZPuGJvx9lqv_ombGSuxUXbPLk0zZxGOioG-O0YMpBBpYw-ET7ZMTH2ewWDub44Bu6XvagZCFQlRlveHcK29UAIaj9c-jswW6WWa7RSEktC-294xsFsnLTaMC_ltMM0jmk5MLBAIDfUt7-PuFc73b4efoycOyDyODEw0qBn4xXOZz-z7tsKp9E6jvfhIPSSYhLxT4lCjwq70yw95G2gkUX5geAtwlXyonVyPX_5ELZ8owN5A9lobBxufPB7kqHcttX6TZEz9zpdvN4HVyXjknmyHaxnKPhKb8p9OpE9BDc8UTZMXgpVDa7K_u_SQlXmiPgEDUI-63zcFckkNCESPQXRRQACddCggOxUCVRM85mg7jU7yWi1HqQ6SHJa2utYY3oML_Ly9aHtBDODQ0-SxSvzzf9VbEKk4OXjIPWDI4znSYf_BAkQ27ozYhrx6eh3BmAb1hOsMg4UpqJcZ1uvaqXUwyx5k_vW4x7lnWk2f5ncimqMb6ep2fc09LhTZhLc9I_Hsdblk0t6ai5JaY7xF_-fQhb9PWrK689i8JEJc3nfN4lR8GjBhKLqBhKHgYGRv4aMffNbpwXyfHmflv56eVfe3APRDvb9xEW4VZoij-H7F6pE8IKNXoToejsdA9J_S3DL9jBlfqVK0CY4XprqyDDQDC34l140lTlwkv8lRveZcCNDkNF74h70KbrA5CuwLya1eLEAgPk97qYqGbj71ihEepcalOeTUTE8b-Co4UDUuK1XUUoY_XLkSMriOYXS-oKmCuoBJfYMu18XKGN4KwQ-U7mlZAiljYWi_w2kE28ZmKjWsFKZc6VcmuittwEgn4l9Tehtw-uryE2Oo-Ap5hMucTXmJJvDje2finaWWzLZ3W2QDqcM54TkoTGyhQccUuV_vMm7g0fKxjhPMeaVTYlLbegwT8wncZcZoZIy1mdXLZgJFeIK5MnyK3NMgEtJepXKdGz6DAqnCiTCXiePwsP7H2cNndB63Gzuq4DH3baqVPwTlCme1GccYlHznen-zNi16nNfV1DGcaiKbK_JNoblApj4TOT569VUZZxt0dKLZhaV219qjFRaQ1ZtCjMv3TQ35YEIrTb2vLY--F21GQ09_P4hSnWNljOpT1CtwISNubqVw_UGm-qzbP6NZYAzkyErbEtfVQVWYO4F-1sBWWJm7SflaDlEV_lWwrRHdOTbp08kidQ2sVCMdbyk3O-_FHlOns-QBbPxgqBzvHq0UpiJHftY-Q5Sq0A7hEKKOLnLJz1_buvWFxOMsRjFrEaBSoFlFB3wqXCixWO8Rm84T6EaAke9eXSd2tVJnsQUnBeNPt7QhgGYEdd6lznK36uj4KkqyXaB_M8vX6maxJ4M7DAwiG9UtazvClKTuSXotlGCQ5uSq3DngizsP3ZS8s3kaZPCnMCvQJ4ZDUSOwFhXUVcca35UCaOAowpnon7rKCetzMFOj0EtYYP9YWqty1Ou4I405sQtpamesq3Khp-nmDo3TlKSwl1D4UpERK4z6D99icHsRn9D0dEA4kfTXiE63Fk6YzV4uk37jFUx9adu9NPmlhkUJKf2NGUoUB028IFuyT1rdXxVbueGcC1A1mObxizQUtuIZbx2An_7-jT8XifvDZz6wHm7wNjcGLq9fJA9Vtl4ooXi3nepdd3L6kD_kNbzv6Y37FJQTFoUzzzTt7LZYYZCzA4R7N2hIgsdVl4DG0D4tLTSNs6T8UITZU_1ftoxJtpfGDcC984teVo671YWJfbqLw8sI3aBFPjIu-b6o3oA5qjORHtTLWTwwzK75-E6RWlO0BEUIfRebaslP0PijPKdZ7YzUrx8Yv_WMNC79KTdzQ-heprVwH6aD9WADKpFnKieChUX8Hky8Jk-EUgRH9f4-a--FgBuR5EMJvLBK4kr-9R7vkDoZb5F15NT8QjZFfCYPb6Ybetxf5w7gRTxLeZis7Euq8hzS7vYVCpnRPOQawxvBpOHcaMLYRLNzgMsxkOldDuPhH41GWLqBwbSmRROzslPKbX2PnDX8RJwHejB6avcNGsgnzxD3ckz5N_7oqVFYN_OOYZutDD8-CQxmlVzQjOhxBZoZxITSHu5WNJvKh8y-JjUEuYaBoQ1Tb87D1QZMw&cid=CAASFeRo7bt7yD_WllkU5vJsnhtKVjgKFw&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9baddb8feefc210583efe3494d5164eb03cc112249ea74dea14110afbcd8c188

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12930
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7073 42 B
107 B 23ms
22ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B1NXQHZkepRr1gMrwpLmlt0fuEeGm1Z2xPYJOpMVvLpN3w0vOSsMpEb22QxsOEM8wnvMBBAC0lUAxPRYHx-RtMnQ1ddHIiUkyflYALpo0JZAjhrhM

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 7073 3 KB
1 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1005
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:48:31 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7073 122 KB
37 KB 56ms
46ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 7073 14 KB
6 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:11:50 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8756 624 B
559 B 62ms
30ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJb4yM4CEJrn5_ICGP7H77QBMAE&v=APEucNUKpYWTrAHzM3A3ugBxoYkxA5aa6lBjWDXeX2bOS9opkj-zfZwM9zBNLD6LslROeeRNiCpoIXoBC4-Wa7A92g6tCyfFr8sjU-Bu_xBKHP_OGAtPyi83EK_Lvs7BX0LnjqpiSbbingTegY6AvXC3GSwSpJReXGWproY97FEKq9AIbrXQygY

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJb4yM4CEJrn5_ICGP7H77QBMAE&v=APEucNUKpYWTrAHzM3A3ugBxoYkxA5aa6lBjWDXeX2bOS9opkj-zfZwM9zBNLD6LslROeeRNiCpoIXoBC4-Wa7A92g6tCyfFr8sjU-Bu_xBKHP_OGAtPyi83EK_Lvs7BX0LnjqpiSbbingTegY6AvXC3GSwSpJReXGWproY97FEKq9AIbrXQygY
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 03 Oct 2021 02:05:16 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlxJKnanxQjN4UiEYHhojLKRJC-imMaJ3iA_rXpwpbwT_zk5Qshh9lFYPhx; expires=Fri, 28-Oct-2022 02:05:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C2A8 53 KB
25 KB 106ms
74ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BWCiNrlzRVAyLnDOrq4Alh6Pxi_CYpINcqPv6M31aoJXMl3wTeq7GhWateZp36ly-Yf62J5zO8rW0T2RAT-i-o0uvdLnzoqdvkZys6MoM8udgkhW9IK8EIguMWWaGj2NzLDqO24nhSGU08c3hJYk36t5e_wA&dbm_d=AKAmf-A2LGhsMhIYh8tXTwaI_mJn2aC7xxi08K_0NIDg361jkgyzTP_hdeGG_0d92bpNLnY5495xq8TUJ-gHqIRrTG7eRpfwfAUUR72Hpj3WB6SvwNZBPRm2JvXcSHx338CXGx0Od0lJc_qszGTyXmiU_dWdFDYKjrlzJ6TiJ5q3c3q4Nwhoqj-2VDKE4MaO_xfENlzEKbbxREORFJd0dPji8X6A4tz7oE-oU1QsNxwUWRXgFo3IfTadSAOzosC9XY66EUNA8pqJoNF1aluNFwaMZ7upTsWLHSUw7BYwmPLceJ19JI1hmL40dc4ys4uF8v4G_tXgQvJG5Y0o8yYv3I9vhDvO_kwkg0u2Ro9-FD2mA_BXRxxqfaU_btakxdBPtfCRI08QG0E09UKAE5BtHGW90oyyVhsRp5gXTDxTU0cHISEEv4PkqWAvMlxtOA6qLcu7E2IsZ4wilSv9r2nrjXCTEsibAPVbE7FSY3FIi0_ZWieZgQz0c9-N_C3BqY7OmNfthCwDW0rCY6Tiuiui4ueN_BcW80v2i37wbKE_DqLXPleZ5udOXudZ3P9aJOWlGqqC0VD-Pyqd41jsWV2r6HlN5WhC5-u0G2FFkxJLIDIqu3fG9WXUimUt_Ut3jzONGVX1xzkr-NSAzUy3CeFiov8KvQChcUWifMIEu4xywFmWIKrWZoc79Jq45SFOqzE46PrasrzvFT0HMcSZR2IrU7QsuaimXS3kvmvuHuVgi5MseuVY7R7CFtGWzgUUYLTPh3TvXaHZveEmzDVE_W-CXO80dy1uZAfhwO85-HnUEOYe3clRUeyoPRkDQ_EQrZ3DTPDZ9vlQHs8XyzcwNLGzZWMsIYLxTguG2-U4VpPRhy-ClqEvgSwHa681ZIUkcUKYBBFLmgJF0W53iUw5gjSTJuzh7OswiGML8CczycZEKo9iEU8PAPnfbiVvkMf-NT7DICO2AIAO9OYVztl0yljBuyisktjLD95nDVBe5IB-0l-DGTBiAMNuq5wJJe-IlPKMXa9BsqmwkGxlIN6CTeaA7d_3GovEObbWiZlBl8ezpnd7_TemJyaTybMCgomhcNpNcCqZxjcGZStEahSjnGB2nSINqM5hKcw17pq6MEgikIR8zz3_aMCusHl3KS5yvkXqjx7FWhigMeyqkn9XlkeVSwYjwV2i1W-6wUBVMj-OiHZ-VtB27H86B04Syi7gnFp3egGCNtWXfwxo1CqUkueSqFpN8Z2nTX3XjoaXp97FCdzV5XE3ttIZhlr0MRH37qHGKEFAmFbsWoY5h3qHxOOqi2LZDFzvaUpoBrvO8fOsE9OHKEA7AmPBS3bQOf2sjfhaw6vM1mEthx44n87_PquZGWUWo6MHVrZDH_9G_08mCsKgVfjsridsqRLtl6VAFjWyfPwt6AJPnv2F0i0OnIh9NpY4ijydotSeQEcJC2PDbuByQNeJFxegzg91cy676Mwc329T8_c_PKWwnODNIAOuDXupZnXDjNTnV-dOdc3hDOnlFnBoLYcEil_O7SAm7gra0lN_3k7Q21jNbTNUSUgEfaG0EzER56FrxoUYPbsIwvckTqVs1Egnr_h444PmLj8ErOEfNXgnD5_Mw3XGUHZic-FIZJ8sGqyHK6XX0Df8sXTljO7_07Kpvj98_1uae7F_W0cIrg9KvKFDxEO6VKzxy_8SBYlmjbl5eA1P6PCk8HWzntMpI4xXyF6BtseimkEyCQ4sBC_ztoN95C0Xiyz1Dq2rsnHlrS-99MZ2sDHoNkD6yvCme4FFTgrvVs3C9URmbj8XnGxC3jenDjmlh9-NiryABhU6BGP-yGPlISuwVjldm4UCBTqnoQjBTd5g4P0ft2UtQkA8FvL5zjSGhlP5PLDlXJp8LI11wuxjLARpDQASooknpL_L3h1JJZt0ghcJjInPKMxEsFywz2oWGvj78DPWvZriuHjAuzAq41Q05vvdaQKWFruDUCH2lDcTmm3N3XmTRZ8fhIlkVqqWmOSGsG38bYzMhCPBgp37_goMUQeetkFGQVHWloyyWeUpddFhkHl8rOJPQ4shOpFtrIqvusV-kCunYG9fOcjjXQ8Won5sjro9l53ylI8LsZgbovn_ECodMvSUH16szSm1PKVzLyhutDilk-vYzumTowywiy_1rendYu1Y8Ys-6MDgPfPMfVmBqtr8WcP-vjyqsXPe_Q6RioQCXB_CuCPOSCnPKUcdqevp2s9PwUYqA9HNrvX_cAH6eni3_45HSY9lc9GqScInI_ZF03Uns9FjivsN58HI3hmyvMauzzf7GsrIuiNgV0tEhXUWL1DgUznQqMCUkBOaPL6Z8-rBp-As8yzsY4GN6_ZJxfutuuNVLUKM5vF1x1NIUgev35WuZh6ub1rc4LGJFXiEL9omSMIizKmbOUY5XQr6B77Sv7s8U9jdEkvjD9vuw6P5nYYXVVlnyhOpLDhC3SUtfJPJOHvsh0qlzsJXXYt7jgiOd1zVWPLKb6bv-SISVpFlK1Y3V1I8kmnVd3GYPKyfm7L__n3ayJRKCeESGXkQHdlHkHSLIgpGjHs46k-gUDWb26ciqyBqxWT65JiB_Oz-0LXx6AqwLwHiAZq17CduNZDMnpH2jMy3qvt3P2sfth5KuRNJ71QXof36uYq0lM_se2zXsmHqjveUxCzCuj7MHKt593yy-oh1Ho4ynPVqjFd_4U_K1gw5to7VZBMVtKvV6e9FqVYlAGJj9GvC35masXKZp9P0J9IQKzAvt0eyrMpafDeD8r922AWlVhljJTY_iKNfCAOLVteTU33FReQqOVyrO-orsMYm5bq6KyVoA8al0Tjnm4RaMYR4KqgDN4CAnxNm1j1_988-emUlBhpZOQHQ3V40wZDIbrqSaq5Jw0JEcg6XLLlegeQyuB5JS3YPRuhLf_MocEUQWSzzM4KjCnHuMG6w4D1kSR7YKyVK2_t3mzGNGXGh3rV3zC92l0BOgau4xIAAvaxcP4svtNHinkFKbNoWXYPDUravUI5MS0TW-ILeiJCHWoixM269osx5PS0uATLj2by8N9K5M7qncOCUWmygCUVmcqrfhubg4SaQBIkyf8Zstc4lsCzVERJ2VntaL_POxChv-zQFGkOAkgWPxCc&cid=CAASFeRoWvwv3W8q427k6temlq381_HuwQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bede68b91d210dadc81778a33dffe1b7600193e000f0a82598fd0098d3487bc6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25253
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C2A8 42 B
107 B 24ms
23ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DArM0LVEamnCGfV7kH4Lb3VZV8S2dSgBqRqXheZ0f7EF5dwZXV0ViyjMQwTpu7xgC-8PFvyT5av4k4MgY48dNFUuYBVdUrwVWGMIIo9UdJ88muZsc

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame C2A8 3 KB
1 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1005
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:48:31 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C2A8 122 KB
37 KB 49ms
41ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame C2A8 14 KB
6 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:11:50 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3D41 624 B
996 B 58ms
28ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJb4yM4CEJrn5_ICGLTRubUBMAE&v=APEucNUlC2O39XZACTZzE0N_zCy4k4oWrDgpn4Bl7DHmhF40B-0vNHujiqPzBVdmsfhXA1qwwOWvHpiFk7r2E_WXtaakCvO51gwu60U3MlgiFbiX9Gq2IiGFVnBnrpjfVzaIWH_lOS42WqWism_ByV9950NZfFoMgPYT76yFWX-WmFkDNUbWPsE

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CJb4yM4CEJrn5_ICGLTRubUBMAE&v=APEucNUlC2O39XZACTZzE0N_zCy4k4oWrDgpn4Bl7DHmhF40B-0vNHujiqPzBVdmsfhXA1qwwOWvHpiFk7r2E_WXtaakCvO51gwu60U3MlgiFbiX9Gq2IiGFVnBnrpjfVzaIWH_lOS42WqWism_ByV9950NZfFoMgPYT76yFWX-WmFkDNUbWPsE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 03 Oct 2021 02:05:16 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUnZ4eaQeyTXm3l9Hk0b9_N9GKVbSR90dKSdq4ucRG_MjLC9Q9GI2Br_u4Em; expires=Fri, 28-Oct-2022 02:05:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DF25 53 KB
25 KB 119ms
89ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DGc_c6E97gdfRdEmSFCD0-r-RcwYlJqqHckuuEvtY9jm0uUE9EqhUlHlmjq9F3CHF6Ta4ktNCU6WxBza7YHyHJXNMN1ZzdTJexeqiHv37Z99txIuRExzlBmgfDxfkyiajd1J8k9aq0IeXeQqtHt4TSeXDQkw&dbm_d=AKAmf-CXzaxYEFviNgakSV6E1p2uSJYwIXb-5ssMCp4XYFeBNTkhKpLf8lrrH3_9uCG_XS7H0-kX8gPZgq65Ogj8GpITo57Mufc4i19-ILAKREOYDvqQ4RN5qrnFeZCp4qZMVFCcG-F06svA5GFSm7eq1-14M26Soga6Xbm8ZR2M5KKFCgdNXlRjGaBMhYXYuMi1pM9NebbPoBZJZl1Mr2X2aMBmGCP6OKIHnmdxL3GLRtjlXzQdIg1uVoQNi6jig2pGNDoEaGKh_hQ_ykZjOaj-2nj9i7HXbKyFLSVr6XQCGG273agyF9YXQ-iq5-0ENfFDTAWWAqYJAOXwen5nuoospJYMxQDKLWoQ2K5UbKLqQq6qSfaQdSVgyv0pkL5d4R8pWMQrQ4SXbvYtWcYWWz0hVSHLELCj3QYEpoyuNRchVi8cXrUHp-zebg5NJWUiKQmvi3q9wwb-uaLqLGNimhxxTrNoTJldegANuGxcsfpTckmvq5TB3gyk5jnKElw1TvmWjCdiUOzORGY-xNiH1aue0JaHGUlYEAGKt9bQXPsSSs0vM1GOfwAd3z_tU0MBBosUMUaUHFSho0xv3__DhP5jZYAjVGP51b8zFn3J2QqApRlX9YNaT4VVC_bJ07cdsf8YfsFu2PRY0rr3A1yX0chwDTSjoo2bZiwWc0-J1sHGX34I2Jdh8-YUASqZaEG-606B01XVd7S-IJjWu6OwaCWF8LtMQn6FgLTZuOIO6DNHt2UvXxocD0ks95gxigMvx7jAFUud9AdxfZw25eHof_MM-Dsi5JZGQn4fVMpidgimnTqbkxD2CTkT_azHgyLFaN_qCchMTcPjgFSp_CUTglf91-nZzYU--ku6GSqp5MJXVV3p8WoAgJv4cC5VWhl2DV1i39jGmA2GvYPbBGlZFjr6p2nVFLbgly6wRl-viNQ0bFJXq0xusQGDqVQUF9QXJ99o0ZXGJG_65_SkK67wp07H3SVuplXspTAAlxmqOORzhEq1DrRg9Em7PVu2WbnzCEfgmYSdArerppNX1sXTEyvh2ckTAixMS9I6f9pyIQG1fOrmTiudU86wOMgdV-2l3WZDDLcLUaoXu7gIMXpTlYq0bvzEEty3jOUvJsjKe-6lkwXB4cD_ShR7Vp6AJrhCc527KHOJBivPq3kVSMcK0eBkhwq3oDDgAD7dPvlvsAONWNkMiCxtfeJ_7bgwZqW2bt0fS7Kr4C82AVlDQGSRPcgkU6zSOeAocW_0JNWsaPxi5xrjUcHhTX_v2g_gX5WYVwm5oLT84sklUfG4Sh0Am79F88CqfzROrJdeFdlQEYV8hoeOFVQF1rzI2SHDk8bv3nmHls4l3WOjNVzuypeOI5eTQ8sTB8ttsn4U5A5-Gp-pmXo3tFb4_-lZmtQpXl_19X8PdneqI5la4jVeLurRDkmN--eN8RP6Wzdp9Gtta5A8hmqG2K8zFqsoPMazE_vamMXkp4xpwbfGUIRbID7vm4_k7uYdMOKh46K0-QMDpk9JUj54YY6q62okEPGIJgfKmYVuZMKsQRyTbMdeauXn41p42mFMpJjLWVTk1rELVLbNXyCba37VLjx7uic7f6ahjBp60gN_mGCuhBEj92W-MJoTrNB0kcn9qKR0nRTSNB_3a8ong2nDMr1OLCqIxE32AL7Tvc1vqPuL5LnQ1sU0_pRvlRb2TmR_EHvDamE_tThyJiyPg6kZ4P2dEyHF8NoaYTtw-DyI3g5yQSaAqaCL6rtVrMgqVFxYeWs79xqC1JSq7BpUAidsbA8e3AHLxLx-b4F2ougEGkYVr5v4HuqQqRoKJfh_xa_DEuMVQNMcw9PpawiIC7Zor5HfifyXv_dasR-0PjA1wQ1Ax2yWd6c75qK2gLSsGYrXACknbjRjh7XVNFfTxpUij5BfIIh2Onv8CzcUk0COLAhA4bCjKD-bn_Rky1IFDj-RDz5YHJdOiqovzjUTDjnzBjMqVHSc0cCVVke8pWTX0lNPjUd5quFjVj_9DSIbmVvUTD3VBTClZcm5QJEXYSz36aZs2ECXLCZyjRGWPzei6_YsQcUBsKt4TlUaJQ-4UR3ECGEkaF_knA8NX0jSQ8Za24pVBNMReW8AM-EiOJrY5bWIWkqUM_NDAYd7qrQa1KkwMzF9jF9irzpxS8Y_54ofaiD91jyJ40R1y3WcIkuJI_105Ky4vy4SvMAfQ6ECLHFPmQLH-BDPJx1kxq0jnNKPZqhtRvQr_cQeBEZXOlTzgzZh8YgB5erikiWdiUXakaAIzEUOF1_C3xHbDW9E7wVQlP-MfkiDmzlCBLkCvhrX4M8rLBN2RA91v0DKqMJLp0jj7zIH1Lo0avIdhCyOJKdEisyizbmjob1EE9P_gV6XJDsMrCAJ4WG2Igm_Lwq28kvZsnXF_Rwoeyv554iTVpXdwobvnaYnZ7KA7267aPal4gqZrmm1YJWFQ6PZLAgC76OcOLP6aqa7kIWOKLXcHfSzpMiyZ8AWnnD6Sa5jKUP2i_e2V0qJDNT1eDoI1j65lJaqURHbv8k43DsPLseeWc2hRNjPNzyROoxZDXLVk6hPQthKn888mw_Z1sAMoDjZwXXbbdy9c-D0XMPwDKeIawARNIjpQc4usZXfyd49t7ZWJE9XjnCoc-r-RnwEglfshJFeL7_cmpyYa8SzK26hlorPtKfEJZi97Uy6Z6b7PYe6B1lG0LLl-eNyrdp-2la4xugTH6XP4stHlc4sP3MEJ4-JxZFWuWtZ9J1HjmDmzOKd5QFJHTYcOqAbDuZECLnJfxKIQSvW3YQduic59lLu5qkFTAvj7jMzLr_4JLkHm1bwqIpNYAX5Z9KaMG-wjuMAfoVYacMG4Lk92rT6roWajLbJgDIZm6K7KB2vsWp-17k8QI5NyyDl1EwBj-nkqF76kzPJPvSFM1oUvlyeK0zvnoUgQxaXQpjJ3LKU7r8-auJeeKLDGmgAf75CUGOBArMZ5Ya6dzW9qMGBRZLVyPL4qDrkyk95gRHgQyFbZUjmkdYON74Jc8NCJdhFGQ_0EKroXmfaCcFsJCZ0c_l3D85cIWQsvDhkgwxsjosK1btRVXbsCRBu-IvgFfAANFXupMGJgo_HC1peJFeFiH_7ElfW-WDkRl4&cid=CAASFeRoPwkC2X2DVCf3HGI3yAUoJvoOug&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

80ef027cf49c5c1086a7de52aaff3b73ce10c395bf9882258f1e2443627a6791

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25506
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DF25 42 B
107 B 23ms
22ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AMCV-lWP8LH5XujBACqkBjyKigwQX1-sKCrvzUqsVsayfJL3UdetEHPpxUpB_24hGEdPjusKbm1LvIJepjWLaFwYS7GekB-luezubjSG1lYmxOnfo

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame DF25 3 KB
1 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1005
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:48:31 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DF25 122 KB
37 KB 53ms
49ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame DF25 14 KB
6 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:11:50 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A358 624 B
559 B 65ms
38ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhj1nOe1ATAB&v=APEucNVcMa4WN2HDmQnHHb7-Uw89sfzAZ-DjxAY5r0D2z5_VdPpH5eEYXnUi7SbVp0-aAUFibsOwf7or-8zZvaElMgoV7BB0qYCxbMHBgt04crVV5fAaRMgXto-yP1wTZ-I1C1pEgaM108My6pFY5knGCQZCFzIoFAcSJly7fo7C3jU6W9YQvZk

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLOokgEQ4p3QAhj1nOe1ATAB&v=APEucNVcMa4WN2HDmQnHHb7-Uw89sfzAZ-DjxAY5r0D2z5_VdPpH5eEYXnUi7SbVp0-aAUFibsOwf7or-8zZvaElMgoV7BB0qYCxbMHBgt04crVV5fAaRMgXto-yP1wTZ-I1C1pEgaM108My6pFY5knGCQZCFzIoFAcSJly7fo7C3jU6W9YQvZk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 03 Oct 2021 02:05:16 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlm9eihD7MyHq9AgoFUwLjQFQrH8eYMMUug_IkoT7dC8hAh9oIKERqJAC8-; expires=Fri, 28-Oct-2022 02:05:16 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 801E 70 KB
28 KB 97ms
71ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BVupdWhARBbyYQ2_bcq9r5o03I1V9s4auwmO7orBr2QwYNWnEm8Jv1fAhknMIn2d9UY8WpmOQn8DzJ3MxxtUvmxyvY-6nZg3ziVOwe4CQICNdf4qYe850Gi62WRwAOn4yIyl84fLAijz4ebEuLmal3HjseLw&dbm_d=AKAmf-BMhiassPWCKr9CP2qsCCYjPfUOpfAQl5UArHG69oNXBHcZ-1WeQff90Zt_2_k0F76gB_OtbvV-SF_vnWOEunYyaUg1wGiN19MpF2JSiqDlaOsGNhXD1DrmuXms_bwmd4EgK6fSOTSDjRF2uDRz7m38Sq3Vu6MZIakmY3zaoq232hMuzd8rtE6xrGASyGFIEd_g9n8OTPrMDJqQEvGN2AOYvyFR2A3xLFuJIFmXctWPSfdqntzaX7X9T9l6UC795iYGFK43yELmmId7y9cKK8HtG28LZUYsDlEJihqiu__awZwOOuniq8CV5wg3NrZnbwfL94u5LmCS0Ardm7Pv7v7AlfFsbMZVYSvzWpPThE72HuY1vJfBjxaDNCBFG1BIJTkxhH5FgvXFZ_noNpCMxSSWgjb1aqvcNT_BBdunD-i2wEid1KJYX6B5W_PC2ZFYB4HDZ5eBK8WeKgKNhOh86Os6RRwNWtgO42fhgorsywxsdVLFwk0L0I7YfmEnUCYWlHlSDv4V160L80pzmWuk417OyM0TFcdgfUdXp6gzDsvdqaqIAZIylR78Myn9shqd8dB4w8-aXGR-hC8ZfrlNsb12m5zDuOXCA7eEJyxVLwQ0UeKXuvdIAtbENUluawrn8KXUFuRRSjdB-xsD0MuMLZ-qVJP0HgnYNUv1r1PvrGJ2swNjLOGJrn1ZhTHztcgn5WrO-lCuhdl3j_cWyfuomD1jMQwV4Xew0EqAztVryK5Bgots4lNYLZvhPyPlUtpDI9XY-gJRWpwSsTvZPEMn0xqCTIt1rC2sJ60MpqYM97Fe8bW5zIHWlMPXiQcfHs1P7jMfcbj0iCpxr3ZGYctndlO51LldxsmWhBB2rEkjq0LYE6j08IKoVsUwtClPxoP2xeI_PoPskluCEASWIHGvy4DqZeb6Omf0MZ54MivC0nqRuCaFbRH-kgvme8DPhNRrLm19sEWubme3b_0wdKzUQbi65d4FyZb3mJ5AOVo1UjniP_bDiES9rZi9XMqX9Sal186KZoDY8aUZgMJidwCTyU1WDg1nMbLbYA4L-cHSoLcsm7x9Bf5AMI8OepCfc2X_NoB7s4tkvpCLgO7j3VhOF_J6sAwavRWAOQ_sjOv9WZ7Gntjwb3wvANh6eWH41Mlq9kHmmaFkDrTF_A1O05F2QkJx5314MwFwamlVx-K31ntYvh1rLoeG7TfA8Fl7mpjvNy6bb-hUbcFBy2d383-IkVbZJz5hGwEUnBkieWLgjliPQ9rx0-Yz8JfJpJcW8eggYEu_pdQ-EPAq94t2lz4abWVJYJnBmgmD0_FGCegu0O_KsXdSMRAexi2TzJH407RQf3CaxW8Q-lVbdq4L6ZnYPQ2QrVZwipRQVCvLeKpYgcrj76h89SAwL1x6cWpsAOendWT8u7cTVWK2x9OS4xIhH4NSis8t3Tq1NnADZ8urx2re0LPQAbGxVwXNZxXhDT26xQWbmV5DlqZ3IG_J3luiJ5ciK3uQMaBfA4CTMmBdVVjAvJoCILzpH0bjLIWQAYJVtzZo7maF1jfibUTpS4k0ZWoxX1toS8yf1CFSTC8GDThgSvx7szL5kEAJ3h2XoIk-XBeUoIlhBK4prrNkavJabZxiMcK0-88HlwF8sV_didrTNfcsf5FkET0TVj9Q0gMOleEUYOHkJQRSBsb87jPHNU4ObxP62OaQuRlmzrXG2QJe4MrYTUu_V_vSMt7YxKZNAM_IsvFn-9WPC6MNiEEKz9LCPQk-TkXp8aJsKDOZAAKVXj47XJox_rlMYxGbksuLhnhdCOpjod-VAVZ3jko4yq9HOJFnXxCQl4Paqm5lKn9_qQA7ROY9facfWCQfxncfiCdDDR8wLwPgdhUMtD488jp2lmwIlRchXHMudgAlTpXrbuZoub-r7e5f3HXIzRZPi_HEp23goOnllOA5CJzYfUguWPzCmrN4NvandUA6NWUs8b0OqM0dUg8ZNd6Jbdi2_1LXXM5FGqaS1Ke29rJ3wj_Bww6HFP45RxGglX8IMMCLdJrZbx6JK9buQakFCBkiT64aikfpruBn9KDEQWAawlJrJZCP22yGJ7KyDDUq8B0Wj9RMZjHcNLdV_BOV-iwMuHFC1Fa40X0iyR5lJG0ApFNlhEbaFvuPxk-dAK__WURoiSUCm2PgA_RKHYyD-_vl6xChRCrYBeVw42sxjBOeOL97JyBLRztyDc5plWA2whw5gyDI3X-8pxKsADyUB1YUBQX9JxCMjZkqJ6JBWcd8SL-iR94al41GtTNSZZ7uF7t0wzIWaHnwdztT9w_CE9qIARh0Fvd1Rh_NILAUkIx7WtpCnOthEUUV4hZwbYz-X10n3zWlsz-xUQ5j6TcVM3bMGtH4fLYtuk6L21HY5xTFDQfYQSzvHqbGnYTLw0Ta1vwRTBZCYUU11NLbPpZQNxgqF032uoPs5_9YwMigVjFO0G6fBhYq0p-EEUYFmPjoJ42pj3j4jlZei78VZLvCJ2K_V5rk_Xy-D5Ew1RUNFyWSZ7dYAh1Z9YjNCrFtuSdl5_Ce1FKsP2CoqxUi_8lwkzvbMCbLlGEbV0bPrzzfxDb9ZpUCDp5zmW_UhTFyc95iwYYikcAEZppE9MMU-nruRSOhVcaRE-vjbt1nwWRigHMzdcdZps7YRha13Nr9aeqYRDYI5djyFLQOOmZSTpz7HlsYb8hV4LKoZQe97KTOkGtLjkfJtrT8sq6yjquQtGFA_WqCl_QL5pRp-Zmu76jz0gsNZTa6DGEdsIkgwmG-vuPeXkCIy9dig2kC1Myal_JG7_jjw6WmwLsHGoeelaYaAEJf7Ix9T0SCSLwK4-t9KY0S3ih5bx0Uf6BeO5ASbzE_hAcByG4JO0GkuhhkDAvmjXf1Ciev7pnrWrc_BcBe5ypSYtDiX2hFOipvOTNgNlOQ20UZlNqL6q0X2w-CIS51dX8wsX7nCAudRX4fMmvJFl9eUUXGl5yccbOf_UGBVCcETrZXJ_dOzT2Tpfu9bWmXEOhvNYkt-47SA4icozkLBWAwwVQ1aBGqqGBeE-ZhDtA0DwocIa9R6xBrjYlqko-7B2Zh-0qZJzEwe8bNXGAdUPdz4r5ZjJKPLatLsxq0d3CLg7_ysoCYcXSo-p61XpXiwH9vxicqm8yR7cgALcBxfpn5TWyMCNqvTdzx9A8KBglMUGR08NG829_Stu-bVhnOs3uC1zZ-6LBB&cid=CAASFeRoAkbgCDGyegzkQwXOvmlDGNvIGg&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7274c6f9c1bc4fbcae1536325fd64c6408cceb726bc162aa37d0ef4491a6b8e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28731
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 801E 42 B
107 B 24ms
23ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DIrnt-HCvonuw5_fbI8pJUw8i_ONaF0VmyWfgFADzZgm5Hi48ZWMi0ixyT0zaychgPehmALOeFM9RKs23C_J3P4HQH_Wg75caNxJl3I5aq4iTw4n0

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 801E 3 KB
1 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:48:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1005
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:48:31 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 801E 122 KB
37 KB 52ms
50ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 801E 14 KB
6 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:11:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3206
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:11:50 GMT

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 49ms
42ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gpt_2021092001&jk=3166665392651961&bg=!MDOlM3fNAAZE-GIIRPg7ACkAdvg8WsF7U0nL8L5kwy2xf2dqzB6lGga-Avqp98XItOk03UgyObLD_QIAAABGUgAAADloAQcKAPnIHdmJFlZLe60FKOUeLR1tIvrS1V0qMphdQC0GSnx5E1q8P8SjraIcHq_7DKFu5SOfj0MSJjhfPWiULUZzQaaajKL40EZ2ss1y2Qj5Fv1K87WIDGT8f709HQj-n7HeK9rgElbcVLZ8F6kOiovW1T-bCjcfpwFSLmYoAE0vVC2b3PxwJbGqApb0rPdco66epZuH7pfrRb-zzuuF1UFBPzrJIeICrWaTmZ3KbyCHJiaRuShLQxuSitkd2OxYPBRF05s_ZF7OU5bbE9fyhUs7CYYKrA6Nhm306VXNxGdfwTrgOtEAOuxKcVeWeZBBliWX3KvKlBr4Z2Ot0mGZAn8AESHPZb177k0Cf78hu0quLFpUTwlBRZhVG_u8DR_c0sWdZt4cMZCb7mBnA4JI8nQLbfPkRRxBcXDRTCkGg4axyac7sPtVlgSbLgUnfVj3AMVsdONjfNE5046JeR2i43HjL88pIHyYChkhiTqdSPKfbANGnQFkDcVxhBdrxaGNlWbAanH4QucYq1sCWXwWqgj1hPStRfnmMDwtzTzihFV1iXjcOckAsKBmM_pXInR6C_neqgkAppxwjahJjirylO6dyscstbN9akv02T7JGBvGnPNLHmzK6Pq0gxKpytTim3oAsc5mkbMVB90iQJU-L2HEOh5bLnR-E_TtcilAluo-SPBFVZpFw4IPjaImUJkvxUe6fOnkmToHmh91ePgNBe6VO-zCh7-eYMNU4SH1RunhZIg5_iiyukUEPTPb583j95Qp8_KgivQ2-RGIE9F_8PCt5v_4jMuAS-7x7muE330q-Et4wAwdvRs955kgPNpqxDkRhs0XNi1snhMkhxBxXSiQbuw_a42WRqCoq6SgLtJfwmrZrNU17DF8tAtDrMFCDqXohcjNBOE6pI7hXvSREVQt3hXBFHxLw5_qlUnrsVOW5gfYBRdNwHlJFoiO5qiIFLuqme5qtV_okffcoRzLnqX1Ar6qeAS1TF3gvmx4KOb4wTwvIC9THaj7yDHYonXYWy1fogX9L7qoCkfgQHVEuGfO_S467bWrLQGZLKCIlE21fIOSBGOD0zeXP-qts6c1jmi3dG-51g_9jGfwWF2W4zHWnBAF9S304NXBIxdrtxOdFEvNPrF0aCOF2nKvhH56_OWxgJ7p7H9ShUI1xd1OOpUP_PG_tZdvUiX5oIyPNDE
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame C806 23 KB
9 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DL2ywu61KANXxIlU7LwrEqn7QsuH2csM_FziUFQU4n5eC7KPiZfysmfvVoVGvAYTJRYRYLanVG4766VgL5qNrzLjmB4BS3Vwtcn35swb6OA48kfldXMmBSUqtiB9G2fkgTD8lrVdgwNnEYbeF63DAFYVCe4Q&cry=1&dbm_d=AKAmf-A8w0X_gYNz8Bu_QqNZ149gdGk6dC69D6729uH0FxNZ7EguDxXnIghEni1Rt4s-vtQErsdcd4oIukgdTj29ZexoDubDLNPqO0mTk4SsrZsymM00yqM2ck7uPJWKvFQT-oz1dSJ0VK7POheUf_v1puNCstDs03_nlvGGg7oDHW6FMLM5f5P4yjH7zg7G0a03ofsvDjnfPk4UywqBXn6S7bf5Z-A28zKy5Bs3vHpEM2h2huBkvQlCbXyShXrueRbbgemm3pC9ibjq_XfmuAGhtSttsOPru0r0E4O_QfEUyWflX5GlkrEq3EtCdGq2VlGt-F0yeQQ_2htIsufpYGDHr_EU2wlYVoqKgfbd26Ha7pUCjvn6_tIwPGUEe25kEAPvRx44JOjSeiKPhbSQZqSvWZz5REpLtWtHlUI9h6wLVyy8kDHU9PoI5QmQkaLZ0vFiAXazlhOpkEhag5VqyXijpPs5hbEc21YmONMXqSFR5FvR6std1HaNHrtUuV_irO1N98bJP_NV3XJLgsX3JndLpma4RJGRtR03FVq_EXASfdjFZUNNvldtQ76HNZVF_dA6wl3h2OSRNS_1OkuFu7Kg07yCOiVxRxOWlwAJGaWwIkxjs9M5sBIqKIEMxMxRvGimaOnv_OSD-6AY0g8tWM3LnmVjDdkhEUMVV8pzj1q28y24zPJ862QwP1QsJNn1_FMrDhfAA4DgLDZ3Icp9Hl4i6YF_-wnL9o108J94hozR4cJgSs0qk8iy4URlTfPdjSOD8xZACuV-9_IguRfqw0BUHeF_j5Bp7GbzmnR7Vap72c4wLjVsDR72MI3BSu2faKzIR7bZEMaKuIzMK3kZRxQYtyXKHMSVXCYclH2wRwAfmwOfzlLG10VXecYcuyr77XO1hzrCXU1pSscSYJwOhKCQDgFcAO-2_xA-NpQ1ei8KnXHNOFS-4TjkBaBWD0RgKiFHHjpkpnXMOXkmVLmk7ur0EeUdJ50LES2Izcx0_Li-JYwEhewk5DVZI56OI3fhGshZyy9zTtGSNnS7Vjsx5Qoay6xhydoyuqcYS59AxTYljFlun_CwbYirsrjhIE2NtmigYqlXcPpxxhDdymtHhAA0UQ1NGSegopW7cHU9AoAQq6IubRTLwo3tlT7MbV3jDPoXHhFB_eklMBNPMk-9J7CgGDimkTmqnLRr5-4Qy8G-ErU9k3ATVZxwgFBrsArwWYdAqbdnj0KJ37OX_NbJN1njLPB9XJXVv0qTJImS7Mr7ziDDwqLyUfzThrmCLNzQnezWiEyaQfDc_ZKyw0z5_QChT7l_JJXds2_ybbCgbfunsInZQCzDzXryiQwoFgnHZ52WBs1UMs9stIr6-yz7KsByaVJlI3uOZLwlKi3UQTZfFc-kddqludhZGxlkHfc_eM4otce527wKSuyZHUG9rJ9b-_vTugbmZJfMZhHyrySH2cidL9OOEFXOzBiZhyAf4twtGpcL_ax_IAKUbWf-E0Ln-lHyFhp68RFBohEFttXYSb-21Lopa2oNFW_mteO8xbYKtCSL8WbE_r7s6z6pfCx_4OqToNioChkrnj8laVZQlmbC96YCxCy3DPWAqPdb2gx7SVU61fIa-aaif9ID56wn5m_5FGVNx_Mx98wQWsn0GVsLTospCzBPqRH92GDdFcqVWbcQo_kUmuFkj9bMpm1Z_J3lMn-DbVbNJ-VPgCxc5A2Gspob-NRg-W_m7AJrTPmM4ovlgmA_XFeXeCuc7BdBpd94JRQG7yS7vTlWCeP0HXYqIS9hILrWNBx8Ejt4vokTkc67yQyQPcWvJqxze1PVJ4IgHA2gIIA_IOmr4vS5bBtbK9lxxpraYZNiMZQxhE3zzThIqbBL0qgMGxoeSuXqJhvbyM_GKhuzmli00457RYJmT-7MYKZqDFJtBEuq7bJKk6wCpr35yNYNdZ7ykWgZk1B1X7r_mz6e3S7mQyoQveZ7Y7DQZv7kRzS_V3pyexANelqC8OUqXkgQLdVPhOfaGvTT9N-DVEPUny08ZqZYrhGOvO64d9sb05g7PIJeeqe4CstvDKqfqAu7BW4zkG_J53psIN-h5P4-6X8nQJiQk6-msOqEBzfgu2_TYlx9YEZLa1n1vhZ7srVCuf7UwqTWBQvxgXyOsV8H280gsoDhDfe5a-PRWtFVj5MeaY0PGT_fNi7qV3I7hs1p-rwMmbFeEfDZxTWTrek0ieTtz2gXTy3LsEnhpDmGOnezdIlam4LgkzpPQufgwrEmghqLc1GxQqUdi5Df1bBGRe88sN7HANtvqY8XNZ7YMxAkbUnaGLhShvvYB1YcYQJHG-WDKybH71S2vV3-iArPJOKSweySH3p1GzzcS86Hog97o5FkCZ5zMTOXfYF5uMhEh28smjyHQ11AEKb7-M-5gn1WVwh3gGd19Pb74ptI8-Q-Ptwdnebp_Xaa0CCJZvhVENkl74ivdxijKq2p0kOid1X8e5B6yRy_2TSFc5m3qIVQDve4apeHHHY6ip9FXrJtPwdvHOCsBsAfPDKrQhrCjwT1dmCesX7kD4r1Us7pDmWuEkbI5OHBdUMiOkU-NVBp-a9Ln2KjUVGcOsAv-jYrRx3Nx-ToiktGMcqe4zswW217mc_BTIps5Po_RQ8qizT0njmHwv4m7NguNbpsVMPUK2FcghEt-ZpJ6RAR-P7dcBm9NeOlJ8H75idWsdV1P5CH0_c0ANnTROjd_0mjZcZuARftJPh1a7Px5ovSVVvwLHQfC1jw9SgaICCKAAC8T6f_la18elk44wps0bOxRNHhweARpBqrRk45pHEi3-Uy5GHqJRxs6rnAR3Iq5WV3Sx2Z8BqlgccQpkW2EolCzHsz8pAUuXEem2wYadPxO3H1YEwOBedx5c2CCg4o89sUoxznw90G1sjHaVoCzZOFx0Ib3OjLWWXNJiv_8XJW5V3WwVqI3YUQB5r3n4dtWQZqrL_if60TBBz_DDIFTslGM0j-iABl8WOvomckg0Ra3fHYKV66t9rQO0n6Lh-gP_J7OkGc_Vr05syySDjoNte53QH10IVdkP0Gyilg4JqL8c0Mj4Izv1NT_k07x0MEKP0Ualk-nsxwQ6-OgorestL5TA&cid=CAASFeRoVvJMa5i0-hq4TfPoCUKLrvXMTg&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cc64ec2f55ae9d24be2ca2bd4f933dcf99c9be0ae35871489cf235d5cee6af0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:34:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9205
x-xss-protection: 0
server: cafe
etag: 2170525750406684717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:34:29 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C806 41 KB
15 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 12:36:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 02 Oct 2022 12:36:28 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame 2D17 23 KB
9 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DqD9bwHkIY6fqYeUcMHjyqoeM0lYz94a2LxDAO5cEcJv0FNwS1-7ABJniPZ3hUvw2SxcO7h40dYFxpTGlDPwwGI_v3AuZBr1Y-DqHbtjvafjHsSFbjkYADVrw7U2oBgwfQ1nLKrN4qMC_UJRcOkpK4tS885A&cry=1&dbm_d=AKAmf-D2fdgBv1jK0y0Prkk7umxtokS1KfVPzUu-rHY-35YK0gSF6jvl54fHxR_A3Ic__Ru2Op5iYj6VFFUobXoglYI3LJ51lPf1lhuc6srnCYvceL8jfpihi6Fb49HFb8ioLGMqdKFgdh4kjBi1ByxjANp4xuUHDfJAFD6ebttn_GDJuF8zeu0wLp6WdJ0dujEr7ZB93b9nz9YaY0hOn9B5y3M25tIrKR6zePEVakC8gbD_JLpL0ucq7WbOl81iJ1Z_AGTVOe6npYGOx4kjUHJcZjeJUcuVPKUvRBgUpGsSD83_jy0lGLk6QnyT1iGQL44laG--Gp6bzglIYB02iCPzvLDfMVUei-fF4juYIgjLz9CghJF8UNM0licC0dVRY7uqYDLwpBrGL23weeXr80BUz7FqaaPmk_peHzkgzwz2gL2_C3OitWkAF5W5ow2Fe3r7UVSufcmsGmdX7O7lFcN0oui2zZbHnhTju2vBgI1HZC7HMfcKCyCp3n93wWu_s68IxsN9wxs3mEQGJR4C0Y3VUxIlZ2FjjNd8Jqi0J0gErCTvFA7vBhUuC0o0tU3xL5VxkI_of_o31osPzlsZcDrakQTxyiOCLH-P_4nSQghgiToA2BgZe4XhEECZZrd2XWAG892jXOdStaqXYLZ5Epk6wjuYNoWSydemi_pd48BUu7lJRnEOFw-dASIAEXxDiDIik521pten0na2_yAefueXpRYi7eny_qUMCcGp1xv9Hg4OA1rydtBCgvump3VdAjfYTCbUSrosz3ZTHrveWiR-5AfP7n-saMVNEKb6nwtxaGrrvtvwoSbcxbyj2rxHQagnKQ6ouz42K64aHa2cWMSZ9cDuSOy6nxvp4L2diKm3M1qy_9qdAPEshR8jyJve9LT0ET-S85-PXa52wNWulwGb1RV4lGLaeXi3mIAn9mcWx6aOASlfmpF06dB1vnN5vxVxwOK4GNewmXFU2gFfhDThQCkf2SsAmFTHK7PruKTHc7oFqPmt-_Gh2R2r5a5jY4xDIw6a-Grsg9GJYsWxPc5cURnNJyJcU8EGCWhKJQpwLWlJMok-UZ5OTfj9OeAh34OgjJ-M0MkL19DRgwmidReVNZi0jZsN0np5u34RO7BRzxXR1IKI2DCiCSZJb--mjF2sKGXnXOHizScgVTX2ATw773sl2VT24XpvhfYu9TcqnONjAGbvm0K7SaQ_7VXXnvr2q-9inbjnCq_ycZZWHb8PVgATFyvPzZ2EBTcAqcSIlttb1SynFv6AG5kdZf1UDrRWSQiwzgxFI8Q0Uhw_pczVDIQbWGh0Sh3NrfcBagb-LARSHv4dTp-yXV6yOHJVy_L7Kfx0YrPogP1K9SRv0lGxwXBooio_ifQCLS9C8wcVrpsbMsphY9fHiRNvLr05NZCZBcMBZb31uNWENj-p1SzTPr8mqdhsbJaq0o4OhvNpdVGP9JHcj5ySeFOXg5bIQDQAiF4F6K1dK_jgfQjEb15mkLZhVR6BPkgQDNM3ZQ_HedM9X04-pznxn8HSgxy1P8elEXRh2gHs0a5Blxd7t8jVxpzvD8npRYE5yYgpGAW_ecy6b-Bs8dyFP1TeblC-3eFp-Fep_o799rFbd30ywnB0KJi6EVpo5-eD_dz1XgN9n2fuq__Pdk1iC229jtHE0zPUUub2IdwD3ZP-QJdjlUzT6U14Qrcy_5rIAMRV_TRmwfRtht_R-E-jLdTSxSfFPAagYxviS_Ajx-bO3kSzRm57BRw3T0O48xkT_FIy02XghWFdIiTztzb6VGXYN8rXgdG-DybPw73FAA5Gox9dyTJXQWURrEESBHFsKJ55-WFycXlnyEr2--vZKfZ4g6pP9lud9TgUkpTOpW5pbWleyNHAAEJl9-WOrzT9oOYvG2Sysz1j6zvWIMR5EYed20xaMuJD6n2JtbWhRAKiX0VTcrMK4UpmNjn_71CYzRSecVf6DnP21r5cDhgHV-Jz9jJahqja0WPgOVWHDmYeZ_yY5_7HkkOdn-Q_phkztq1CzorS4_DO4C2v2x8MkuynLX3uWEKNxmNceFYut33WBrv5T-b9QR1nXlQnR_aBjF2HZ88P7Kupdjrz3GR35r6yqdvm9bIsdvx3hjxg4blBl_q9nk464ICDi2kbKyInLm4INWnwXrOXLnobEoDf7Y5ynoPBu5bCxSVkstb4tpEkyZcF1UkMtPDfAERUUYidnt6AoeIda_-X_1TBsEP1moYU5uXNV3wxqmsdQtdSuLTXtCKPaohswb8zXMgXgztfxP9XmBgWByUNui_uTWdoUzrkTPFxmSaGFfxeJoSyICztpCcg26l_6L5QAamMAJgnPIHftz4iXRWe81Mj-96_UxWjzMrU1-nWWdkv4C0c2MFtdrqxSq1DZOzwM0fU7pbS1QJMlg_e30ntGa684bZTdAN0MlqDN4WTBfAwgBpXmSakyd2YbFhe4V6b7cCyfGdO2PbKoY3ojvjOl0gQI9ndiGH8BD5_zGugi0_cPiF6NyA1uspo6K-l5NhRXMMDWhlCZlzlyKL7pKqV56L5vk69Zr68kLNRWRn6MYRZW1rMV1TBOBEx7VdGDJ48xbL4PuUuN6L7vFUMuKGLKG_tyiw5yORdDB5UhYmUmyiOThRQdnjP1Kf2kUOuuwNaJw0xvuWDhPuI6x-Sh0ZnUG8CNcGOI-Bh6UzWtycLSrxI2YOi1f9mg-m6xdWOE1ihLJqqD3o5mikzgSRYuc_yMSIt4SYqsB6E69a3CK0QxKOSC1CeT7Uccg5vX6YHLcEF0ZLa1wNNuZNvhQIJJROFR5xbttToMSFiSlHnc0n32GUB9_oA5NOvn_BO9pMvuP-QEKZp_U-AOiC7avBjCi_5c7ZPQ9J9wr-bakZ1VZYaVF9XGGUqM1-pOSEBDCbMs96xixwXbBnSoJBLsVcAQNCjANPzTCUA3wP6vSyt48SGBRypwDlr4VF1fwfI29X5dMpR-_YvgkRrGqHtumkX1WlE0mwINIGZtgqhYztipOuneI6PvqwvrdaNuhysFVYVjrY285ArViLQRuyM4NVcwCfaKvp7UUu5CRHp1FHYI-fZRo43A2teE-0My3x5f_Pd0JonmPUry4p9zZM_Zjb293GwWQx3-q-j53Xj3VFdPSTPOzhXp6KhMFSRmH2a5gxzpUylQiIpw9qV2ba7zuDf4HnKs-lKzW90-Qg6YgnwdYiNzj4aUg9G&cid=CAASFeRoWgq4v4Rs6wL-ObHvsNp8wFsDPw&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cc64ec2f55ae9d24be2ca2bd4f933dcf99c9be0ae35871489cf235d5cee6af0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:34:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9205
x-xss-protection: 0
server: cafe
etag: 2170525750406684717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:34:29 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2D17 41 KB
15 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 12:36:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 02 Oct 2022 12:36:28 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame 7073 23 KB
9 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Ddz0uB5PfhH36k9pDma1otKQhH0O4j5Vq-ml60sIzn5RTF2v-XxajAisDBcjlKT3Fm9RCVF2MX_pVFfJJaiC4fj1tEgjoD2rjoH_v2VbMW59Rx4tUpd4inDm3-Lf0yi7ExkFj5FkQqW1ZHs_67C4n3f1guoQ&cry=1&dbm_d=AKAmf-DmaxHjMuy2qgSydJmTWWx4AiLaTDclQP8XXyN-K8nzYx0c6YZKue-96zDmPG-2gj_4jed-WNAIBZP8mbOfDoBQsfR8Nff4CqF9l8Wx1AjbIK4JWmVCQcMtuGLUm0GTEuU2KDRhFnHGf1mKbEnEeZm9nG5cdiH-tnyzWFmZpQF5e2jsnBnSWXcGMkQyvKTCRlFVfq48t8YSBkjeKN4yHaNOa7DFA8MvZBsPnjcTg4OSGW8esFtrSQIm-u_dTiEArNr8Gi5TjwgGrCcYsTpZQ00kIS-aF_MSt5iVmHSf3vLZJoAY5hcGrDuWNpJL7eYyBYhmwJy1ZeUrpYPhvkVjnyBvr6QFDWKe5va0SjhrvC2dLtoZ9rgx9PgMnh64gkxXbgxPwLWViWTUAMjJXbce4TKsK5fK8HWIl4GDLspxiG3B_pYgv_-Gr6D_MFmXH7P0XCK_g8iFCj-SGFfHnFCA10uS17bsrIRZfSgnKnMlFUOJIOjPr9p4SH4eAjpismgniMJXcwlBa8RbvtzFRRqglRx0Vkhd8cxapDv5PIP5lSJQ-E3ebBjqkf_IXC2HBlzi8gbC0lbUKMFyXZOwH6JZx41zyVJ-Mvo7wk_ksooutrEaVnNiH108Aj1yPG5XEiH_V-iFFmEcQ1JSySc8rDgM7Qc76FDFiOTUaPsB_sSoXZper6f3C3Xsc_ywT7yXNWsb4rxNyFAxOGl7R-Y-vNt4eE7dOeoBToqb13GBd_UBX9U0qmzmnsj6KNTkGRoi6o-Euanhy4dIK3c7fPQAbdD2m9m6nsoxUUVwhcQXqqW1K7JwOUQ8YVqPQ7Wvkf1mNjT5YEgs-HySVADVj4CCYLdgZl4VSQeidTwCE8Xrr6RMfZ35KplY1DXzRpXyI5w-nJ55al7HOFfwy9AgCLAZ00CGaRtJNrLLyMa1tqvj-kvrT7CMDXFFuqy79yd08XHsaVVvLmpewGPm_INQN2bpMmXnN0ZPuGJvx9lqv_ombGSuxUXbPLk0zZxGOioG-O0YMpBBpYw-ET7ZMTH2ewWDub44Bu6XvagZCFQlRlveHcK29UAIaj9c-jswW6WWa7RSEktC-294xsFsnLTaMC_ltMM0jmk5MLBAIDfUt7-PuFc73b4efoycOyDyODEw0qBn4xXOZz-z7tsKp9E6jvfhIPSSYhLxT4lCjwq70yw95G2gkUX5geAtwlXyonVyPX_5ELZ8owN5A9lobBxufPB7kqHcttX6TZEz9zpdvN4HVyXjknmyHaxnKPhKb8p9OpE9BDc8UTZMXgpVDa7K_u_SQlXmiPgEDUI-63zcFckkNCESPQXRRQACddCggOxUCVRM85mg7jU7yWi1HqQ6SHJa2utYY3oML_Ly9aHtBDODQ0-SxSvzzf9VbEKk4OXjIPWDI4znSYf_BAkQ27ozYhrx6eh3BmAb1hOsMg4UpqJcZ1uvaqXUwyx5k_vW4x7lnWk2f5ncimqMb6ep2fc09LhTZhLc9I_Hsdblk0t6ai5JaY7xF_-fQhb9PWrK689i8JEJc3nfN4lR8GjBhKLqBhKHgYGRv4aMffNbpwXyfHmflv56eVfe3APRDvb9xEW4VZoij-H7F6pE8IKNXoToejsdA9J_S3DL9jBlfqVK0CY4XprqyDDQDC34l140lTlwkv8lRveZcCNDkNF74h70KbrA5CuwLya1eLEAgPk97qYqGbj71ihEepcalOeTUTE8b-Co4UDUuK1XUUoY_XLkSMriOYXS-oKmCuoBJfYMu18XKGN4KwQ-U7mlZAiljYWi_w2kE28ZmKjWsFKZc6VcmuittwEgn4l9Tehtw-uryE2Oo-Ap5hMucTXmJJvDje2finaWWzLZ3W2QDqcM54TkoTGyhQccUuV_vMm7g0fKxjhPMeaVTYlLbegwT8wncZcZoZIy1mdXLZgJFeIK5MnyK3NMgEtJepXKdGz6DAqnCiTCXiePwsP7H2cNndB63Gzuq4DH3baqVPwTlCme1GccYlHznen-zNi16nNfV1DGcaiKbK_JNoblApj4TOT569VUZZxt0dKLZhaV219qjFRaQ1ZtCjMv3TQ35YEIrTb2vLY--F21GQ09_P4hSnWNljOpT1CtwISNubqVw_UGm-qzbP6NZYAzkyErbEtfVQVWYO4F-1sBWWJm7SflaDlEV_lWwrRHdOTbp08kidQ2sVCMdbyk3O-_FHlOns-QBbPxgqBzvHq0UpiJHftY-Q5Sq0A7hEKKOLnLJz1_buvWFxOMsRjFrEaBSoFlFB3wqXCixWO8Rm84T6EaAke9eXSd2tVJnsQUnBeNPt7QhgGYEdd6lznK36uj4KkqyXaB_M8vX6maxJ4M7DAwiG9UtazvClKTuSXotlGCQ5uSq3DngizsP3ZS8s3kaZPCnMCvQJ4ZDUSOwFhXUVcca35UCaOAowpnon7rKCetzMFOj0EtYYP9YWqty1Ou4I405sQtpamesq3Khp-nmDo3TlKSwl1D4UpERK4z6D99icHsRn9D0dEA4kfTXiE63Fk6YzV4uk37jFUx9adu9NPmlhkUJKf2NGUoUB028IFuyT1rdXxVbueGcC1A1mObxizQUtuIZbx2An_7-jT8XifvDZz6wHm7wNjcGLq9fJA9Vtl4ooXi3nepdd3L6kD_kNbzv6Y37FJQTFoUzzzTt7LZYYZCzA4R7N2hIgsdVl4DG0D4tLTSNs6T8UITZU_1ftoxJtpfGDcC984teVo671YWJfbqLw8sI3aBFPjIu-b6o3oA5qjORHtTLWTwwzK75-E6RWlO0BEUIfRebaslP0PijPKdZ7YzUrx8Yv_WMNC79KTdzQ-heprVwH6aD9WADKpFnKieChUX8Hky8Jk-EUgRH9f4-a--FgBuR5EMJvLBK4kr-9R7vkDoZb5F15NT8QjZFfCYPb6Ybetxf5w7gRTxLeZis7Euq8hzS7vYVCpnRPOQawxvBpOHcaMLYRLNzgMsxkOldDuPhH41GWLqBwbSmRROzslPKbX2PnDX8RJwHejB6avcNGsgnzxD3ckz5N_7oqVFYN_OOYZutDD8-CQxmlVzQjOhxBZoZxITSHu5WNJvKh8y-JjUEuYaBoQ1Tb87D1QZMw&cid=CAASFeRo7bt7yD_WllkU5vJsnhtKVjgKFw&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cc64ec2f55ae9d24be2ca2bd4f933dcf99c9be0ae35871489cf235d5cee6af0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:34:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9205
x-xss-protection: 0
server: cafe
etag: 2170525750406684717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:34:29 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7073 41 KB
15 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 12:36:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 02 Oct 2022 12:36:28 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3D41
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFUZEEXS-tNYXygbFtT57M&google_cver=1

43 B
1014 B

37ms
27ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFUZEEXS-tNYXygbFtT57M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJb4yM4CEJrn5_ICGLTRubUBMAE&v=APEucNUlC2O39XZACTZzE0N_zCy4k4oWrDgpn4Bl7DHmhF40B-0vNHujiqPzBVdmsfhXA1qwwOWvHpiFk7r2E_WXtaakCvO51gwu60U3MlgiFbiX9Gq2IiGFVnBnrpjfVzaIWH_lOS42WqWism_ByV9950NZfFoMgPYT76yFWX-WmFkDNUbWPsE
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFUZEEXS-tNYXygbFtT57M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3D41
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVkP3KMRGftEumDcf5bVaAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
894 B

29ms
29ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJb4yM4CEJrn5_ICGLTRubUBMAE&v=APEucNUlC2O39XZACTZzE0N_zCy4k4oWrDgpn4Bl7DHmhF40B-0vNHujiqPzBVdmsfhXA1qwwOWvHpiFk7r2E_WXtaakCvO51gwu60U3MlgiFbiX9Gq2IiGFVnBnrpjfVzaIWH_lOS42WqWism_ByV9950NZfFoMgPYT76yFWX-WmFkDNUbWPsE
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3D41
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEtDdqeXIcc0NOxCOazkLNE&google_cver=1

43 B
1004 B

46ms
16ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEtDdqeXIcc0NOxCOazkLNE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJb4yM4CEJrn5_ICGLTRubUBMAE&v=APEucNUlC2O39XZACTZzE0N_zCy4k4oWrDgpn4Bl7DHmhF40B-0vNHujiqPzBVdmsfhXA1qwwOWvHpiFk7r2E_WXtaakCvO51gwu60U3MlgiFbiX9Gq2IiGFVnBnrpjfVzaIWH_lOS42WqWism_ByV9950NZfFoMgPYT76yFWX-WmFkDNUbWPsE

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 8001e5bc-c71b-475d-967b-a3203bc38b94
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEtDdqeXIcc0NOxCOazkLNE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3D41
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTExMjc0NDAwNjA2OTE0NzEyOA%3D%3D

170 B
188 B

19ms
19ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTExMjc0NDAwNjA2OTE0NzEyOA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 4370c11c-2972-4780-a65e-fd45bf61a4ff
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTExMjc0NDAwNjA2OTE0NzEyOA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 304A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFUZEEXS-tNYXygbFtT57M&google_cver=1

43 B
1014 B

53ms
30ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFUZEEXS-tNYXygbFtT57M&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWJThx1B0qc6JJNVvsPOBQw0ICF416JrXF5W3AqKqRevseCLtYojeIuS0GBO4MwRZK6VcfBbsbixhgzLcLloIVutHnedA4j2SfRabqxiO2G92GDmtrjI71hIx8fFxivykJIJ4BYN-skKy0C9f9S6U2R3rKPY_B7S3SEXH-pzAYRUajj-KA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEHFUZEEXS-tNYXygbFtT57M&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 304A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVkP3KMRGftEumDcf5bVaAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
894 B

33ms
33ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWJThx1B0qc6JJNVvsPOBQw0ICF416JrXF5W3AqKqRevseCLtYojeIuS0GBO4MwRZK6VcfBbsbixhgzLcLloIVutHnedA4j2SfRabqxiO2G92GDmtrjI71hIx8fFxivykJIJ4BYN-skKy0C9f9S6U2R3rKPY_B7S3SEXH-pzAYRUajj-KA
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 304A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEEtDdqeXIcc0NOxCOazkLNE&google_cver=1

43 B
1004 B

47ms
14ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEEtDdqeXIcc0NOxCOazkLNE&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWJThx1B0qc6JJNVvsPOBQw0ICF416JrXF5W3AqKqRevseCLtYojeIuS0GBO4MwRZK6VcfBbsbixhgzLcLloIVutHnedA4j2SfRabqxiO2G92GDmtrjI71hIx8fFxivykJIJ4BYN-skKy0C9f9S6U2R3rKPY_B7S3SEXH-pzAYRUajj-KA

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a3902a67-3d40-4491-a43c-bb05391d8dc3
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEEtDdqeXIcc0NOxCOazkLNE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 304A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

170 B
188 B

36ms
21ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: b4127284-62c5-4e82-ac76-0d68aa4acf1f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 59AC 114 KB
40 KB 75ms
13ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Origin: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 20:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21504
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Oct 2021 20:06:52 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/ Frame 59AC 8 KB
3 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BNP9sMS7yJI31UZrenyhl3WZh4l_DeIUROmPYVU2sPNqm9Nu5wkctD4taPKc0OyDBJWoOQvr5mYNVzaE-CbLlWlYREqequLJ00yIp01iqUXx52cgwCoJ_drhIHIY_3vxj0ErQjrqqg5wzphs00UiUb2XOO3A&dbm_d=AKAmf-BwLqaxgm_Go0yibsTcK5vXSP9cqbCoGW3I3ISKRtMJvsGgqiPkva71dHUiGI0ZxX3VrW7AcReshbC2lIUsEaFHve99yCz6_AKAE3vifsb4abyAdDTh3NXxH4bMzjgzGuo2ZTlTLAatqV3esUgCnLjRorPF2wTFLeEVX9KoZ8CbQwPZ7hr-mWjRXp06yrMzY9RbBP3IW9sqUyw82TG5ClzL5zwTjPzPSVDLj2i25aGPT8syb_2P6JxdgYf0b0jhAh44M1ogTrRkX0I67agyRyffhGSByLJ3oiRIphaEECOFKKbAX8iPrFVl0uNq5hmFCI8-rAz3sP54kzY0vjlN9O68ggWo_eMvduzqPKBJ12VDpHrWb9NtUywdsm-7TwkNq8hNAV85WVaVksrAbf7V183I3Noo-0FiqvHXon-5neF0xXYYY1mgAElFqxETKfrUAtz_l-NICKoAn4DRM-RhnkCFxRBXNIOtcnbY33CJwJZqFBduG5rATK867WjoIJ_m-QyyaH3gKEPhz1o47rrVbDITHc__nexoSv5If8ImwGYFIbmIeRRa5Ad2XfyV1J7JcAjms0wfCE42ohKq3kNkOw1jWrAdoat0HKviof33smZAJLgJODbsPIXf7wclus4Bsa03cfkNzevHCvLByazqy4_i8YJT3xgNxoUoa3FB7deQJE7rSxJ9lpTLJXc224QDy5uFkO0eG7M5AGLw3yWO8_CxvCrn4sXxTDzM9K6SoY_KKPWK4eHJS0V9SjOVlNSOzN0BiZxHaV9Sc9eUIskjiEPKdLvtWYXgUXcxj-OtDVvEqP6ykHWishsbEB5C7FhtbSY5wL2Ke7rve4qTSgqLF_Dl-fKBtgkTnNvOBKqxKM02ZItX2LMbY8PocRpRVl9M486gRY_iOE1M_iK54iWXDdGUtpfiW0itzOgUeDr4DyqlW-RUki1Nggluj1f781UVtc_iX8A_gcFbfdwg920_XQjMQ3OSSkjfzEFzygxG7l9dIJjt_8xcJ33fXxKslZKwPmN2LtEibf66VtjAoS48xATsZiVJA1M1CJ9KN7AyRm2IJzdwpf3sRxLEPFCMM3lzM0G0qkZznPQqU75I9p21YrCZkOy0vLyLqY7zUtJY9N5HOzgMJ5rKvEqV0XrHeLWUfr0imvJHvRpp-vQeb2qooFE14TlcHTTSuI0vQ8sXX8wZHOha6zp38zZbQSXzh8t2B9Y8EmUVp4-1GsS25BDRBxok3XDHD5BJ3VGeOuTn_4-hzSVcJ-1d0jX66gpGpm8ge004kWjp9BtBOQjukrTWU8N52ey_9sP2W7rbZn-big1brYy1REeqERccPUq6mjUiqQCxXBi0Wx-dOHJv19HHb_gsV1wYvOdjfRTx_IxIvsePNl2rrpI13Jeuh_HtDCEkpW-eYtgYjZ-hr61AV_WG93H5BPszNXL-VAkwv5fM6oGlY2wGKASbNcAd__-X_fakKxBLA0joY4JJOfFxBl9Glciy6mupo0xoeGuWWVjrORwOHIau2EaYLO5DXbKBJ5icA_2RfeP3R-TqwPdpRTk0e7Fut6B7rnFC0n8U54q7Vr9zn6fnrATA3u6hinexPvXWeClLVLYkelSfpHX79x0aQM2TNOQEdN_79Fd3NDMBe5BqgmxPnnwu4N1YHjoYMtIVbG6rw5NKm3ukMwfM-ZHc97VPFKX5p-LDhgjMWst638QKEL4sd8pkgocJLgVp45ln01cJ4kIZI4PEhyhAIrFNkyKB89nTW-9S8f9adUV4o_acQf9i0BSHikd2eRgeJwf-YU0ZRypOb7cCI28zAIhMlYml5o_lu-0acBN_WC2kIBzS3VqurfnewFcVrzQFu65_yJDWYPUBASQGrmCLJqxqV_mcpeFkuSs_sS62RTnsDtsAHWMOktbVeb8mvVUR71DVCHAH29LP4Kaoss7PMWYT5_ALE8peTyS4LEdVkj3wRvKoTx6hT2akxwuSObj5jhw9JQ5RsmHStndX1bcsZSAT-0_AQWVxPhMF8EzSV6tZu55C2RBpCkZnxam_w3k-9gtE4UOTdoSUWfVEPXZdqki8tbwWFwN9XDdhOtEXQ8ldPI-AC5NkpBsY6wJgNbCar_dM_eywR71ydZPeswHK8IEGDBBVlNDK0OY93a5hWGiYkzzfW1qWEv-dnjHAgDZGTTqxAjf2ntHSpGYZk1io4l6jEQW1gTLkVI6AXJzuZDYeqKLHVCNgMn9cvrdBriF1NwooSYdeezfLiy1js3FtV9GVRehewd35P5nMYNfcIpgypdecVBuaR3QiSYyRJg0yrmdWQPKUS8K3psaBilvM5SiuOZnXG5Yx5pamu_4hHQO7dlGNLFqjdTHmT4kfTPr2RYfc6BJU7-zfuJAUduKNvj0YRzsrrV52dgczdN0bi9hfFxQWttAuU3M-RLv5kbbZhgksOvPjoSrC1CasI8nqC2c_nC5bdRZnAmnqB8KqIdWwwIglbeCMjG_nNwKYrhSjLjKjHBDWi_MASwNkaGv0QzX90glOcvSBSUuDZ_c6Pc3-pByVILsnxgMk4CS_P_KaSP5FmyhgGFyXsp0GzCXVIdg1G8crgUmyiyVKyO7slCYukBhFWWxgGPXbNDhnI2zUrAs3AOY07HhsV9Bw8tBi1fOhil-a2gwtq94FvPEmvO-ZRES2zhBGZ5V96tQtaflRbtOrl-3C7-f-MZs2Or5M0STlHKXL-kYb4Iuu5w51RwUEKQ-q0axF58rVW37U_YZ2u2vEDiWJjSnbELz23BAtiZn6EV_-v0xGpoNiVaHfArxeT1EGMIW9xM7baP8Uyol5MenGCeacD88etynjWFJEMeZVbJqySCXu9fRw_cFi7ucO7oW6wjrboUhK6SwXk8-Smbiyzlk819avOHENpl-0qbDiB554UJ5HGCELkZDI3b8U9OwkeGZWvsKpth4H8RguYe9wTzdZao8Ju5fIFAwORqKe0DwFMTMirDGgfVkZBccdLEHBhuOd5Rkh6nSlZH-aZVzVwztoDQeoNrnA3P2GCURl0OYwvuih5g&cid=CAASFeRoV31F2LaeJBLd-qD1Pn8mPKQJkQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:22:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2574
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:22:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame 59AC 23 KB
9 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cc64ec2f55ae9d24be2ca2bd4f933dcf99c9be0ae35871489cf235d5cee6af0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:34:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9205
x-xss-protection: 0
server: cafe
etag: 2170525750406684717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:34:29 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8756
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
1014 B

38ms
33ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJb4yM4CEJrn5_ICGP7H77QBMAE&v=APEucNUKpYWTrAHzM3A3ugBxoYkxA5aa6lBjWDXeX2bOS9opkj-zfZwM9zBNLD6LslROeeRNiCpoIXoBC4-Wa7A92g6tCyfFr8sjU-Bu_xBKHP_OGAtPyi83EK_Lvs7BX0LnjqpiSbbingTegY6AvXC3GSwSpJReXGWproY97FEKq9AIbrXQygY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8756
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVkP3KMRGftEumDcf5bVaAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
894 B

23ms
23ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJb4yM4CEJrn5_ICGP7H77QBMAE&v=APEucNUKpYWTrAHzM3A3ugBxoYkxA5aa6lBjWDXeX2bOS9opkj-zfZwM9zBNLD6LslROeeRNiCpoIXoBC4-Wa7A92g6tCyfFr8sjU-Bu_xBKHP_OGAtPyi83EK_Lvs7BX0LnjqpiSbbingTegY6AvXC3GSwSpJReXGWproY97FEKq9AIbrXQygY
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8756
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

43 B
1004 B

48ms
14ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJb4yM4CEJrn5_ICGP7H77QBMAE&v=APEucNUKpYWTrAHzM3A3ugBxoYkxA5aa6lBjWDXeX2bOS9opkj-zfZwM9zBNLD6LslROeeRNiCpoIXoBC4-Wa7A92g6tCyfFr8sjU-Bu_xBKHP_OGAtPyi83EK_Lvs7BX0LnjqpiSbbingTegY6AvXC3GSwSpJReXGWproY97FEKq9AIbrXQygY

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: afde42df-8d8b-4a18-8b74-fe08de2a8631
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8756
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: be58da7a-95d8-4a69-b3ce-a2a5c02e8d52
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2E26
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
1014 B

56ms
23ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMY8IbfYjAB&v=APEucNUBEl_kb1TOIO-VXwRfecDgOyG3812hWulePfjoyU1NCtZ67WNm9cF77higEhmfuNZYDsTo97DlJWycKiL0-5BoOmeVhE0ZShf2sCwhjD7I1ZDTfdGczLvrzeUC2dtQpV7rXjw6d1Hsh70i2CqpGQtRfGsbqnOPaZrvGWK_BoSUvAYtaZo
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 2E26
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVkP3KMRGftEumDcf5bVaAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
894 B

30ms
30ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMY8IbfYjAB&v=APEucNUBEl_kb1TOIO-VXwRfecDgOyG3812hWulePfjoyU1NCtZ67WNm9cF77higEhmfuNZYDsTo97DlJWycKiL0-5BoOmeVhE0ZShf2sCwhjD7I1ZDTfdGczLvrzeUC2dtQpV7rXjw6d1Hsh70i2CqpGQtRfGsbqnOPaZrvGWK_BoSUvAYtaZo
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 2E26
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

43 B
1004 B

65ms
14ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMY8IbfYjAB&v=APEucNUBEl_kb1TOIO-VXwRfecDgOyG3812hWulePfjoyU1NCtZ67WNm9cF77higEhmfuNZYDsTo97DlJWycKiL0-5BoOmeVhE0ZShf2sCwhjD7I1ZDTfdGczLvrzeUC2dtQpV7rXjw6d1Hsh70i2CqpGQtRfGsbqnOPaZrvGWK_BoSUvAYtaZo

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 51e84e7f-c1a5-4b98-887c-a878cb56812d
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2E26
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

170 B
188 B

18ms
18ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 398ac9e5-6a54-44f1-8fcb-b6935bd249a8
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 801E 114 KB
39 KB 78ms
25ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Origin: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 20:06:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21504
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Oct 2021 20:06:52 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/ Frame 801E 8 KB
3 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BVupdWhARBbyYQ2_bcq9r5o03I1V9s4auwmO7orBr2QwYNWnEm8Jv1fAhknMIn2d9UY8WpmOQn8DzJ3MxxtUvmxyvY-6nZg3ziVOwe4CQICNdf4qYe850Gi62WRwAOn4yIyl84fLAijz4ebEuLmal3HjseLw&dbm_d=AKAmf-BMhiassPWCKr9CP2qsCCYjPfUOpfAQl5UArHG69oNXBHcZ-1WeQff90Zt_2_k0F76gB_OtbvV-SF_vnWOEunYyaUg1wGiN19MpF2JSiqDlaOsGNhXD1DrmuXms_bwmd4EgK6fSOTSDjRF2uDRz7m38Sq3Vu6MZIakmY3zaoq232hMuzd8rtE6xrGASyGFIEd_g9n8OTPrMDJqQEvGN2AOYvyFR2A3xLFuJIFmXctWPSfdqntzaX7X9T9l6UC795iYGFK43yELmmId7y9cKK8HtG28LZUYsDlEJihqiu__awZwOOuniq8CV5wg3NrZnbwfL94u5LmCS0Ardm7Pv7v7AlfFsbMZVYSvzWpPThE72HuY1vJfBjxaDNCBFG1BIJTkxhH5FgvXFZ_noNpCMxSSWgjb1aqvcNT_BBdunD-i2wEid1KJYX6B5W_PC2ZFYB4HDZ5eBK8WeKgKNhOh86Os6RRwNWtgO42fhgorsywxsdVLFwk0L0I7YfmEnUCYWlHlSDv4V160L80pzmWuk417OyM0TFcdgfUdXp6gzDsvdqaqIAZIylR78Myn9shqd8dB4w8-aXGR-hC8ZfrlNsb12m5zDuOXCA7eEJyxVLwQ0UeKXuvdIAtbENUluawrn8KXUFuRRSjdB-xsD0MuMLZ-qVJP0HgnYNUv1r1PvrGJ2swNjLOGJrn1ZhTHztcgn5WrO-lCuhdl3j_cWyfuomD1jMQwV4Xew0EqAztVryK5Bgots4lNYLZvhPyPlUtpDI9XY-gJRWpwSsTvZPEMn0xqCTIt1rC2sJ60MpqYM97Fe8bW5zIHWlMPXiQcfHs1P7jMfcbj0iCpxr3ZGYctndlO51LldxsmWhBB2rEkjq0LYE6j08IKoVsUwtClPxoP2xeI_PoPskluCEASWIHGvy4DqZeb6Omf0MZ54MivC0nqRuCaFbRH-kgvme8DPhNRrLm19sEWubme3b_0wdKzUQbi65d4FyZb3mJ5AOVo1UjniP_bDiES9rZi9XMqX9Sal186KZoDY8aUZgMJidwCTyU1WDg1nMbLbYA4L-cHSoLcsm7x9Bf5AMI8OepCfc2X_NoB7s4tkvpCLgO7j3VhOF_J6sAwavRWAOQ_sjOv9WZ7Gntjwb3wvANh6eWH41Mlq9kHmmaFkDrTF_A1O05F2QkJx5314MwFwamlVx-K31ntYvh1rLoeG7TfA8Fl7mpjvNy6bb-hUbcFBy2d383-IkVbZJz5hGwEUnBkieWLgjliPQ9rx0-Yz8JfJpJcW8eggYEu_pdQ-EPAq94t2lz4abWVJYJnBmgmD0_FGCegu0O_KsXdSMRAexi2TzJH407RQf3CaxW8Q-lVbdq4L6ZnYPQ2QrVZwipRQVCvLeKpYgcrj76h89SAwL1x6cWpsAOendWT8u7cTVWK2x9OS4xIhH4NSis8t3Tq1NnADZ8urx2re0LPQAbGxVwXNZxXhDT26xQWbmV5DlqZ3IG_J3luiJ5ciK3uQMaBfA4CTMmBdVVjAvJoCILzpH0bjLIWQAYJVtzZo7maF1jfibUTpS4k0ZWoxX1toS8yf1CFSTC8GDThgSvx7szL5kEAJ3h2XoIk-XBeUoIlhBK4prrNkavJabZxiMcK0-88HlwF8sV_didrTNfcsf5FkET0TVj9Q0gMOleEUYOHkJQRSBsb87jPHNU4ObxP62OaQuRlmzrXG2QJe4MrYTUu_V_vSMt7YxKZNAM_IsvFn-9WPC6MNiEEKz9LCPQk-TkXp8aJsKDOZAAKVXj47XJox_rlMYxGbksuLhnhdCOpjod-VAVZ3jko4yq9HOJFnXxCQl4Paqm5lKn9_qQA7ROY9facfWCQfxncfiCdDDR8wLwPgdhUMtD488jp2lmwIlRchXHMudgAlTpXrbuZoub-r7e5f3HXIzRZPi_HEp23goOnllOA5CJzYfUguWPzCmrN4NvandUA6NWUs8b0OqM0dUg8ZNd6Jbdi2_1LXXM5FGqaS1Ke29rJ3wj_Bww6HFP45RxGglX8IMMCLdJrZbx6JK9buQakFCBkiT64aikfpruBn9KDEQWAawlJrJZCP22yGJ7KyDDUq8B0Wj9RMZjHcNLdV_BOV-iwMuHFC1Fa40X0iyR5lJG0ApFNlhEbaFvuPxk-dAK__WURoiSUCm2PgA_RKHYyD-_vl6xChRCrYBeVw42sxjBOeOL97JyBLRztyDc5plWA2whw5gyDI3X-8pxKsADyUB1YUBQX9JxCMjZkqJ6JBWcd8SL-iR94al41GtTNSZZ7uF7t0wzIWaHnwdztT9w_CE9qIARh0Fvd1Rh_NILAUkIx7WtpCnOthEUUV4hZwbYz-X10n3zWlsz-xUQ5j6TcVM3bMGtH4fLYtuk6L21HY5xTFDQfYQSzvHqbGnYTLw0Ta1vwRTBZCYUU11NLbPpZQNxgqF032uoPs5_9YwMigVjFO0G6fBhYq0p-EEUYFmPjoJ42pj3j4jlZei78VZLvCJ2K_V5rk_Xy-D5Ew1RUNFyWSZ7dYAh1Z9YjNCrFtuSdl5_Ce1FKsP2CoqxUi_8lwkzvbMCbLlGEbV0bPrzzfxDb9ZpUCDp5zmW_UhTFyc95iwYYikcAEZppE9MMU-nruRSOhVcaRE-vjbt1nwWRigHMzdcdZps7YRha13Nr9aeqYRDYI5djyFLQOOmZSTpz7HlsYb8hV4LKoZQe97KTOkGtLjkfJtrT8sq6yjquQtGFA_WqCl_QL5pRp-Zmu76jz0gsNZTa6DGEdsIkgwmG-vuPeXkCIy9dig2kC1Myal_JG7_jjw6WmwLsHGoeelaYaAEJf7Ix9T0SCSLwK4-t9KY0S3ih5bx0Uf6BeO5ASbzE_hAcByG4JO0GkuhhkDAvmjXf1Ciev7pnrWrc_BcBe5ypSYtDiX2hFOipvOTNgNlOQ20UZlNqL6q0X2w-CIS51dX8wsX7nCAudRX4fMmvJFl9eUUXGl5yccbOf_UGBVCcETrZXJ_dOzT2Tpfu9bWmXEOhvNYkt-47SA4icozkLBWAwwVQ1aBGqqGBeE-ZhDtA0DwocIa9R6xBrjYlqko-7B2Zh-0qZJzEwe8bNXGAdUPdz4r5ZjJKPLatLsxq0d3CLg7_ysoCYcXSo-p61XpXiwH9vxicqm8yR7cgALcBxfpn5TWyMCNqvTdzx9A8KBglMUGR08NG829_Stu-bVhnOs3uC1zZ-6LBB&cid=CAASFeRoAkbgCDGyegzkQwXOvmlDGNvIGg&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:22:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2574
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:22:22 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame 801E 23 KB
9 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cc64ec2f55ae9d24be2ca2bd4f933dcf99c9be0ae35871489cf235d5cee6af0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:34:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9205
x-xss-protection: 0
server: cafe
etag: 2170525750406684717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:34:29 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 57E7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
1014 B

61ms
24ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY6s3FlQEwAQ&v=APEucNVghz4vc4ctvn_Y53JWWyGLrHVBGQ9pvFn0cA3NBhL6P37z8a2IVptxnJ_4n2n8VL71ahIkk9ypmmKxEo89gX4CJ-0romSE1Tpbm84eQt-jbpWByva6X3tx4Lu8ghgZwCb2igf3388qL53y2OSr89sG8C-INUnb5zEmeF30zQm9-LI7ZKU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 57E7
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVkP3KMRGftEumDcf5bVaAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
894 B

42ms
41ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY6s3FlQEwAQ&v=APEucNVghz4vc4ctvn_Y53JWWyGLrHVBGQ9pvFn0cA3NBhL6P37z8a2IVptxnJ_4n2n8VL71ahIkk9ypmmKxEo89gX4CJ-0romSE1Tpbm84eQt-jbpWByva6X3tx4Lu8ghgZwCb2igf3388qL53y2OSr89sG8C-INUnb5zEmeF30zQm9-LI7ZKU
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 57E7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

43 B
1004 B

61ms
14ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY6s3FlQEwAQ&v=APEucNVghz4vc4ctvn_Y53JWWyGLrHVBGQ9pvFn0cA3NBhL6P37z8a2IVptxnJ_4n2n8VL71ahIkk9ypmmKxEo89gX4CJ-0romSE1Tpbm84eQt-jbpWByva6X3tx4Lu8ghgZwCb2igf3388qL53y2OSr89sG8C-INUnb5zEmeF30zQm9-LI7ZKU

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: cf4265ef-a118-425a-adcc-0706233ad005
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57E7
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

170 B
188 B

19ms
17ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9ab19605-17df-4649-bccf-4f4acb4667e4
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A358
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
1014 B

57ms
32ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhj1nOe1ATAB&v=APEucNVcMa4WN2HDmQnHHb7-Uw89sfzAZ-DjxAY5r0D2z5_VdPpH5eEYXnUi7SbVp0-aAUFibsOwf7or-8zZvaElMgoV7BB0qYCxbMHBgt04crVV5fAaRMgXto-yP1wTZ-I1C1pEgaM108My6pFY5knGCQZCFzIoFAcSJly7fo7C3jU6W9YQvZk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A358
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVkP3KMRGftEumDcf5bVaAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
894 B

25ms
25ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhj1nOe1ATAB&v=APEucNVcMa4WN2HDmQnHHb7-Uw89sfzAZ-DjxAY5r0D2z5_VdPpH5eEYXnUi7SbVp0-aAUFibsOwf7or-8zZvaElMgoV7BB0qYCxbMHBgt04crVV5fAaRMgXto-yP1wTZ-I1C1pEgaM108My6pFY5knGCQZCFzIoFAcSJly7fo7C3jU6W9YQvZk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A358
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

43 B
1004 B

62ms
14ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhj1nOe1ATAB&v=APEucNVcMa4WN2HDmQnHHb7-Uw89sfzAZ-DjxAY5r0D2z5_VdPpH5eEYXnUi7SbVp0-aAUFibsOwf7or-8zZvaElMgoV7BB0qYCxbMHBgt04crVV5fAaRMgXto-yP1wTZ-I1C1pEgaM108My6pFY5knGCQZCFzIoFAcSJly7fo7C3jU6W9YQvZk

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 946a9886-5129-495d-891d-9eb9e3bf40b7
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A358
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

170 B
188 B

17ms
16ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 3d55fa0f-0181-4b7d-ae3c-8ef6b2452191
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjU5MTExMTc2MzA0Nzg4NTAwMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BA94
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
1014 B

53ms
30ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWfmFSAll_F0op5-ngUO7o-4_ODvuyduOJDmsmUJJLy93Ao3_rxCWNyCT9rPbsuzpSqdxlCqrN3lz5eY5Nw05NV-AA6Uia6cjv2u1OAJXaP0EC6ZmYFPsPqWbmLd4g46iuBHLbdBsHwfL5Rfmxre2CcJSNoxcUp4HFhKZsc-3pIlzMyLAI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame BA94
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YVkP3KMRGftEumDcf5bVaAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1

43 B
894 B

23ms
23ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWfmFSAll_F0op5-ngUO7o-4_ODvuyduOJDmsmUJJLy93Ao3_rxCWNyCT9rPbsuzpSqdxlCqrN3lz5eY5Nw05NV-AA6Uia6cjv2u1OAJXaP0EC6ZmYFPsPqWbmLd4g46iuBHLbdBsHwfL5Rfmxre2CcJSNoxcUp4HFhKZsc-3pIlzMyLAI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKnxQbjtKfoK9ttyRrfUVbs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame BA94
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

43 B
1004 B

60ms
14ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNWfmFSAll_F0op5-ngUO7o-4_ODvuyduOJDmsmUJJLy93Ao3_rxCWNyCT9rPbsuzpSqdxlCqrN3lz5eY5Nw05NV-AA6Uia6cjv2u1OAJXaP0EC6ZmYFPsPqWbmLd4g46iuBHLbdBsHwfL5Rfmxre2CcJSNoxcUp4HFhKZsc-3pIlzMyLAI

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 32efb98b-46b3-4346-935f-466731e84a0a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH00bWwUPiYB3YfCIbUrlew&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BA94
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTExMjc0NDAwNjA2OTE0NzEyOA%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTExMjc0NDAwNjA2OTE0NzEyOA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
X-Proxy-Origin: 194.36.108.20; 194.36.108.20; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: b55a1898-ca4f-415e-ac9d-9ad5ddc35a71
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=OTExMjc0NDAwNjA2OTE0NzEyOA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame C2A8 23 KB
9 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BWCiNrlzRVAyLnDOrq4Alh6Pxi_CYpINcqPv6M31aoJXMl3wTeq7GhWateZp36ly-Yf62J5zO8rW0T2RAT-i-o0uvdLnzoqdvkZys6MoM8udgkhW9IK8EIguMWWaGj2NzLDqO24nhSGU08c3hJYk36t5e_wA&dbm_d=AKAmf-A2LGhsMhIYh8tXTwaI_mJn2aC7xxi08K_0NIDg361jkgyzTP_hdeGG_0d92bpNLnY5495xq8TUJ-gHqIRrTG7eRpfwfAUUR72Hpj3WB6SvwNZBPRm2JvXcSHx338CXGx0Od0lJc_qszGTyXmiU_dWdFDYKjrlzJ6TiJ5q3c3q4Nwhoqj-2VDKE4MaO_xfENlzEKbbxREORFJd0dPji8X6A4tz7oE-oU1QsNxwUWRXgFo3IfTadSAOzosC9XY66EUNA8pqJoNF1aluNFwaMZ7upTsWLHSUw7BYwmPLceJ19JI1hmL40dc4ys4uF8v4G_tXgQvJG5Y0o8yYv3I9vhDvO_kwkg0u2Ro9-FD2mA_BXRxxqfaU_btakxdBPtfCRI08QG0E09UKAE5BtHGW90oyyVhsRp5gXTDxTU0cHISEEv4PkqWAvMlxtOA6qLcu7E2IsZ4wilSv9r2nrjXCTEsibAPVbE7FSY3FIi0_ZWieZgQz0c9-N_C3BqY7OmNfthCwDW0rCY6Tiuiui4ueN_BcW80v2i37wbKE_DqLXPleZ5udOXudZ3P9aJOWlGqqC0VD-Pyqd41jsWV2r6HlN5WhC5-u0G2FFkxJLIDIqu3fG9WXUimUt_Ut3jzONGVX1xzkr-NSAzUy3CeFiov8KvQChcUWifMIEu4xywFmWIKrWZoc79Jq45SFOqzE46PrasrzvFT0HMcSZR2IrU7QsuaimXS3kvmvuHuVgi5MseuVY7R7CFtGWzgUUYLTPh3TvXaHZveEmzDVE_W-CXO80dy1uZAfhwO85-HnUEOYe3clRUeyoPRkDQ_EQrZ3DTPDZ9vlQHs8XyzcwNLGzZWMsIYLxTguG2-U4VpPRhy-ClqEvgSwHa681ZIUkcUKYBBFLmgJF0W53iUw5gjSTJuzh7OswiGML8CczycZEKo9iEU8PAPnfbiVvkMf-NT7DICO2AIAO9OYVztl0yljBuyisktjLD95nDVBe5IB-0l-DGTBiAMNuq5wJJe-IlPKMXa9BsqmwkGxlIN6CTeaA7d_3GovEObbWiZlBl8ezpnd7_TemJyaTybMCgomhcNpNcCqZxjcGZStEahSjnGB2nSINqM5hKcw17pq6MEgikIR8zz3_aMCusHl3KS5yvkXqjx7FWhigMeyqkn9XlkeVSwYjwV2i1W-6wUBVMj-OiHZ-VtB27H86B04Syi7gnFp3egGCNtWXfwxo1CqUkueSqFpN8Z2nTX3XjoaXp97FCdzV5XE3ttIZhlr0MRH37qHGKEFAmFbsWoY5h3qHxOOqi2LZDFzvaUpoBrvO8fOsE9OHKEA7AmPBS3bQOf2sjfhaw6vM1mEthx44n87_PquZGWUWo6MHVrZDH_9G_08mCsKgVfjsridsqRLtl6VAFjWyfPwt6AJPnv2F0i0OnIh9NpY4ijydotSeQEcJC2PDbuByQNeJFxegzg91cy676Mwc329T8_c_PKWwnODNIAOuDXupZnXDjNTnV-dOdc3hDOnlFnBoLYcEil_O7SAm7gra0lN_3k7Q21jNbTNUSUgEfaG0EzER56FrxoUYPbsIwvckTqVs1Egnr_h444PmLj8ErOEfNXgnD5_Mw3XGUHZic-FIZJ8sGqyHK6XX0Df8sXTljO7_07Kpvj98_1uae7F_W0cIrg9KvKFDxEO6VKzxy_8SBYlmjbl5eA1P6PCk8HWzntMpI4xXyF6BtseimkEyCQ4sBC_ztoN95C0Xiyz1Dq2rsnHlrS-99MZ2sDHoNkD6yvCme4FFTgrvVs3C9URmbj8XnGxC3jenDjmlh9-NiryABhU6BGP-yGPlISuwVjldm4UCBTqnoQjBTd5g4P0ft2UtQkA8FvL5zjSGhlP5PLDlXJp8LI11wuxjLARpDQASooknpL_L3h1JJZt0ghcJjInPKMxEsFywz2oWGvj78DPWvZriuHjAuzAq41Q05vvdaQKWFruDUCH2lDcTmm3N3XmTRZ8fhIlkVqqWmOSGsG38bYzMhCPBgp37_goMUQeetkFGQVHWloyyWeUpddFhkHl8rOJPQ4shOpFtrIqvusV-kCunYG9fOcjjXQ8Won5sjro9l53ylI8LsZgbovn_ECodMvSUH16szSm1PKVzLyhutDilk-vYzumTowywiy_1rendYu1Y8Ys-6MDgPfPMfVmBqtr8WcP-vjyqsXPe_Q6RioQCXB_CuCPOSCnPKUcdqevp2s9PwUYqA9HNrvX_cAH6eni3_45HSY9lc9GqScInI_ZF03Uns9FjivsN58HI3hmyvMauzzf7GsrIuiNgV0tEhXUWL1DgUznQqMCUkBOaPL6Z8-rBp-As8yzsY4GN6_ZJxfutuuNVLUKM5vF1x1NIUgev35WuZh6ub1rc4LGJFXiEL9omSMIizKmbOUY5XQr6B77Sv7s8U9jdEkvjD9vuw6P5nYYXVVlnyhOpLDhC3SUtfJPJOHvsh0qlzsJXXYt7jgiOd1zVWPLKb6bv-SISVpFlK1Y3V1I8kmnVd3GYPKyfm7L__n3ayJRKCeESGXkQHdlHkHSLIgpGjHs46k-gUDWb26ciqyBqxWT65JiB_Oz-0LXx6AqwLwHiAZq17CduNZDMnpH2jMy3qvt3P2sfth5KuRNJ71QXof36uYq0lM_se2zXsmHqjveUxCzCuj7MHKt593yy-oh1Ho4ynPVqjFd_4U_K1gw5to7VZBMVtKvV6e9FqVYlAGJj9GvC35masXKZp9P0J9IQKzAvt0eyrMpafDeD8r922AWlVhljJTY_iKNfCAOLVteTU33FReQqOVyrO-orsMYm5bq6KyVoA8al0Tjnm4RaMYR4KqgDN4CAnxNm1j1_988-emUlBhpZOQHQ3V40wZDIbrqSaq5Jw0JEcg6XLLlegeQyuB5JS3YPRuhLf_MocEUQWSzzM4KjCnHuMG6w4D1kSR7YKyVK2_t3mzGNGXGh3rV3zC92l0BOgau4xIAAvaxcP4svtNHinkFKbNoWXYPDUravUI5MS0TW-ILeiJCHWoixM269osx5PS0uATLj2by8N9K5M7qncOCUWmygCUVmcqrfhubg4SaQBIkyf8Zstc4lsCzVERJ2VntaL_POxChv-zQFGkOAkgWPxCc&cid=CAASFeRoWvwv3W8q427k6temlq381_HuwQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cc64ec2f55ae9d24be2ca2bd4f933dcf99c9be0ae35871489cf235d5cee6af0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:34:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9205
x-xss-protection: 0
server: cafe
etag: 2170525750406684717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:34:29 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/ Frame C2A8 8 KB
3 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:22:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2574
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:22:22 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C2A8 0
346 B 55ms
39ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssQ0HcEovZG4KOoCwPbMlMwQSeiUPF_WnZgCgjr_WpE1mImpKr2JdGfxQ21gb54c273f1Be3cmkoawYwZyH9bwmhGSbMsuQ83rulcpBWSiq8-v0ks7Ss00ph8fbk8sr4VSmZXRIycut3BP4YRtH9aqPvEl4kHUImYEIjNX2PwVH7qjId7mrlVLztNOQRWJgrkM16epK9eSSGUS-pxTMhYX2IuojAxg9aE7pgY-nA5VILzfHd5IYi-FcrZyNvWFeeNTkHTq_-ZMqgRb5LOP73yGd3wEPug3piA8SFHDUnv_jmXF3AAY6BWfptw9fYdSY2OatGaBadVHvs1pk9sGj4l1gatzvVsnU4S0MAXJbbcRPr9ZIJ4_euxV3pZ7aaF67dF0_Q9ULouviu-lrt3KSUvZUaM0WYuDh-4LB6-2Aq2Ssif7KGxPASeKU_PeHTRuLzoFR1LNzoTO1tOj_AjotB_CLw9M5Jghct8uWIwBTvrzYUjn9kht58KYg7nbPL8PbU1OKERcyKnisDONixaKZImP_QozajCTu6dK-aOuRQyiU4I2cTIQpAOLLwnEEgqJM-zq6v9_I9UG9LVFBM13mvmzWNaNxGXkSWv7HCApv8W63sGOQMVDPacYQSqa5Oc_cWxvH6deJvk7R9qVgbmrMlHMNjXZUxegIVcMjIZkX_pyM8DujI3yTcTT5hyVBdXGAs0BEF0vVMBvZrBqPUiZIok8TMDo5QbboYSPtFMsjN8ZKV235HSdh0uvwJ-IthKELSww5ULCNuNUeGDZUJetqsk2y3SOXhPrUriD_nRSvv6zyHr4bBySo9Zt4JCNndeBkK1xR6q1r97Ee39h9L85UiHtzlgM7Ot7C9PK1tZWYg1urZYbTAFB9D2guaREN8GIeff4z2d8Wqjldb3OLU_2hpa8G2W3_YDgPGo8Vv2S0RusXvccWlIfFTjRg2t1C2fyYKXpkYHY_Vei4LHcm80NImt9GZRrNxLKecT8vCiRfkPLyM7SZ6xeUEJ1IV3qaVFWwq5mLLzA27dnpNQFeJxRe4pJmUeYLtOvD3lNX_cTg593qkUibYGExnw_j2YgZZdXD9KWZ8N13-8iQzshP3CvcX5g1RsKK77CyJSpLTifCokHPrEbApjSlhqWPnC9gHPCrV1rlxXryKmE&sai=AMfl-YS7KhV9Sv1ZMHCif3XYaw1tBD60ySo8hIWGK2R0K4jWIJJhrWzWlz8E8wFnwShHxZCeoRurpEsT7K6Q11USv3l-gsU4rJ4fr-FDBxs0awax_SIiFB7CU8X9vBlviaTKXaKqJLvfEDN6qKVQfbYRyJt9RP-2b6jOE41qjPE&sig=Cg0ArKJSzH2pH6SzeyRZEAE&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20210928.30602&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 03 Oct 2021 02:05:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C2A8 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 12:36:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 02 Oct 2022 12:36:28 GMT

GET
H2 200 3788574907631481854
s0.2mdn.net/simgad/ Frame C2A8 51 KB
51 KB 49ms
16ms Image
image/jpeg 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/3788574907631481854

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

704f085bde4ce93ce6ef48f08ca9fbd9069373928c9b74416e5259ddf2eb1b3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:39:43 GMT
x-content-type-options: nosniff
age: 487533
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52495
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 10:00:34 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Sep 2022 10:39:43 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame DF25 23 KB
9 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DGc_c6E97gdfRdEmSFCD0-r-RcwYlJqqHckuuEvtY9jm0uUE9EqhUlHlmjq9F3CHF6Ta4ktNCU6WxBza7YHyHJXNMN1ZzdTJexeqiHv37Z99txIuRExzlBmgfDxfkyiajd1J8k9aq0IeXeQqtHt4TSeXDQkw&dbm_d=AKAmf-CXzaxYEFviNgakSV6E1p2uSJYwIXb-5ssMCp4XYFeBNTkhKpLf8lrrH3_9uCG_XS7H0-kX8gPZgq65Ogj8GpITo57Mufc4i19-ILAKREOYDvqQ4RN5qrnFeZCp4qZMVFCcG-F06svA5GFSm7eq1-14M26Soga6Xbm8ZR2M5KKFCgdNXlRjGaBMhYXYuMi1pM9NebbPoBZJZl1Mr2X2aMBmGCP6OKIHnmdxL3GLRtjlXzQdIg1uVoQNi6jig2pGNDoEaGKh_hQ_ykZjOaj-2nj9i7HXbKyFLSVr6XQCGG273agyF9YXQ-iq5-0ENfFDTAWWAqYJAOXwen5nuoospJYMxQDKLWoQ2K5UbKLqQq6qSfaQdSVgyv0pkL5d4R8pWMQrQ4SXbvYtWcYWWz0hVSHLELCj3QYEpoyuNRchVi8cXrUHp-zebg5NJWUiKQmvi3q9wwb-uaLqLGNimhxxTrNoTJldegANuGxcsfpTckmvq5TB3gyk5jnKElw1TvmWjCdiUOzORGY-xNiH1aue0JaHGUlYEAGKt9bQXPsSSs0vM1GOfwAd3z_tU0MBBosUMUaUHFSho0xv3__DhP5jZYAjVGP51b8zFn3J2QqApRlX9YNaT4VVC_bJ07cdsf8YfsFu2PRY0rr3A1yX0chwDTSjoo2bZiwWc0-J1sHGX34I2Jdh8-YUASqZaEG-606B01XVd7S-IJjWu6OwaCWF8LtMQn6FgLTZuOIO6DNHt2UvXxocD0ks95gxigMvx7jAFUud9AdxfZw25eHof_MM-Dsi5JZGQn4fVMpidgimnTqbkxD2CTkT_azHgyLFaN_qCchMTcPjgFSp_CUTglf91-nZzYU--ku6GSqp5MJXVV3p8WoAgJv4cC5VWhl2DV1i39jGmA2GvYPbBGlZFjr6p2nVFLbgly6wRl-viNQ0bFJXq0xusQGDqVQUF9QXJ99o0ZXGJG_65_SkK67wp07H3SVuplXspTAAlxmqOORzhEq1DrRg9Em7PVu2WbnzCEfgmYSdArerppNX1sXTEyvh2ckTAixMS9I6f9pyIQG1fOrmTiudU86wOMgdV-2l3WZDDLcLUaoXu7gIMXpTlYq0bvzEEty3jOUvJsjKe-6lkwXB4cD_ShR7Vp6AJrhCc527KHOJBivPq3kVSMcK0eBkhwq3oDDgAD7dPvlvsAONWNkMiCxtfeJ_7bgwZqW2bt0fS7Kr4C82AVlDQGSRPcgkU6zSOeAocW_0JNWsaPxi5xrjUcHhTX_v2g_gX5WYVwm5oLT84sklUfG4Sh0Am79F88CqfzROrJdeFdlQEYV8hoeOFVQF1rzI2SHDk8bv3nmHls4l3WOjNVzuypeOI5eTQ8sTB8ttsn4U5A5-Gp-pmXo3tFb4_-lZmtQpXl_19X8PdneqI5la4jVeLurRDkmN--eN8RP6Wzdp9Gtta5A8hmqG2K8zFqsoPMazE_vamMXkp4xpwbfGUIRbID7vm4_k7uYdMOKh46K0-QMDpk9JUj54YY6q62okEPGIJgfKmYVuZMKsQRyTbMdeauXn41p42mFMpJjLWVTk1rELVLbNXyCba37VLjx7uic7f6ahjBp60gN_mGCuhBEj92W-MJoTrNB0kcn9qKR0nRTSNB_3a8ong2nDMr1OLCqIxE32AL7Tvc1vqPuL5LnQ1sU0_pRvlRb2TmR_EHvDamE_tThyJiyPg6kZ4P2dEyHF8NoaYTtw-DyI3g5yQSaAqaCL6rtVrMgqVFxYeWs79xqC1JSq7BpUAidsbA8e3AHLxLx-b4F2ougEGkYVr5v4HuqQqRoKJfh_xa_DEuMVQNMcw9PpawiIC7Zor5HfifyXv_dasR-0PjA1wQ1Ax2yWd6c75qK2gLSsGYrXACknbjRjh7XVNFfTxpUij5BfIIh2Onv8CzcUk0COLAhA4bCjKD-bn_Rky1IFDj-RDz5YHJdOiqovzjUTDjnzBjMqVHSc0cCVVke8pWTX0lNPjUd5quFjVj_9DSIbmVvUTD3VBTClZcm5QJEXYSz36aZs2ECXLCZyjRGWPzei6_YsQcUBsKt4TlUaJQ-4UR3ECGEkaF_knA8NX0jSQ8Za24pVBNMReW8AM-EiOJrY5bWIWkqUM_NDAYd7qrQa1KkwMzF9jF9irzpxS8Y_54ofaiD91jyJ40R1y3WcIkuJI_105Ky4vy4SvMAfQ6ECLHFPmQLH-BDPJx1kxq0jnNKPZqhtRvQr_cQeBEZXOlTzgzZh8YgB5erikiWdiUXakaAIzEUOF1_C3xHbDW9E7wVQlP-MfkiDmzlCBLkCvhrX4M8rLBN2RA91v0DKqMJLp0jj7zIH1Lo0avIdhCyOJKdEisyizbmjob1EE9P_gV6XJDsMrCAJ4WG2Igm_Lwq28kvZsnXF_Rwoeyv554iTVpXdwobvnaYnZ7KA7267aPal4gqZrmm1YJWFQ6PZLAgC76OcOLP6aqa7kIWOKLXcHfSzpMiyZ8AWnnD6Sa5jKUP2i_e2V0qJDNT1eDoI1j65lJaqURHbv8k43DsPLseeWc2hRNjPNzyROoxZDXLVk6hPQthKn888mw_Z1sAMoDjZwXXbbdy9c-D0XMPwDKeIawARNIjpQc4usZXfyd49t7ZWJE9XjnCoc-r-RnwEglfshJFeL7_cmpyYa8SzK26hlorPtKfEJZi97Uy6Z6b7PYe6B1lG0LLl-eNyrdp-2la4xugTH6XP4stHlc4sP3MEJ4-JxZFWuWtZ9J1HjmDmzOKd5QFJHTYcOqAbDuZECLnJfxKIQSvW3YQduic59lLu5qkFTAvj7jMzLr_4JLkHm1bwqIpNYAX5Z9KaMG-wjuMAfoVYacMG4Lk92rT6roWajLbJgDIZm6K7KB2vsWp-17k8QI5NyyDl1EwBj-nkqF76kzPJPvSFM1oUvlyeK0zvnoUgQxaXQpjJ3LKU7r8-auJeeKLDGmgAf75CUGOBArMZ5Ya6dzW9qMGBRZLVyPL4qDrkyk95gRHgQyFbZUjmkdYON74Jc8NCJdhFGQ_0EKroXmfaCcFsJCZ0c_l3D85cIWQsvDhkgwxsjosK1btRVXbsCRBu-IvgFfAANFXupMGJgo_HC1peJFeFiH_7ElfW-WDkRl4&cid=CAASFeRoPwkC2X2DVCf3HGI3yAUoJvoOug&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cc64ec2f55ae9d24be2ca2bd4f933dcf99c9be0ae35871489cf235d5cee6af0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:34:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1847
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9205
x-xss-protection: 0
server: cafe
etag: 2170525750406684717
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:34:29 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/ Frame DF25 8 KB
3 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 01:22:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2574
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 17 Oct 2021 01:22:22 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame DF25 0
61 B 46ms
39ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuX-lATjgmdJ1tzCv7ZGaNhPbc7tiT7xkh2JmK7Qf6poQSPck5lVfd82oiBcoJEYizjB3eGXPb5i_fSEaSL4-8rPhccGGP1vhfU_6MpN-Bdppw9xseOTgLFBHs4zb71dMXBRcRdmb71hxxAl16K4-pD4wItTemVkF8OxGdhAMJzgQx5ySMXRPVOCU3A0ouvYd2_HILtOLxBlBDpdNMHepC-ZObTutkfNZjwTSLtGurVzh6zZKROPa1Ag3KYaKb06dRRWt-3kZ3-BhOVQyFDqO_Fzz-szmVl0vi0UpVZgacH3av0IskPn4HpxUpbwPj4kMEe1EN9B9MqlTy0IPPq9dtbXJyCArzn-8Ajavt5XLmXZi6EMm_odszx0nNcPGdb8kxqayR-LXafU4-a_-322lk65t_mEoxWikErEccg6jaXo8EZg6HxCOHSCzJFK-nmL2n6a2C37t82i6gg0tvMrQbXmQ-igPUQ6pyP8iEQiZlBvSE3KJAj2BA7IdQmnb1CBx0FQsP_5188QWmePn77ShR4Ok5Qs55cfjkXEMGG2k_Bu36XhM-z2aWdnOUQ_g1dKpy-HHVUc2L5vgh8CmN2tCVj0MDKxifGq4FqW4JagB-vZ9EvO8qe3uuLa4WdaVm_ahN61jjL1oW8RknmePJtmBqRfjCjlaccdHLXaDcAN3htyLpp-wuTtNoFoIW6yfGEx-s9pUAQbGb99Iv697PoI4n_oRlkodizlp4b9EjkMBS683uYw7Cin_z4-U8PbrlBPvt6EUj2US5P5CPObDfevMsUw-6V6Tw-VsZApQA7SYDYkWl4N9CqNxDBTJOyxpxTRrgwixPJwAsrcp7OYGmlXmIfanZjNRQfUD1r2nE0ErenwjXxCZxmYxUHtM63XwldbVQwap92K31oXgYzV27alklI7sgV4y0OOm2Ou2hbW-EFCA7r2URIjudAqPPL12tHLncm2hHiofZ04lc_jPHH7XN__fCqk6aXDDj4TGpMrG1M3gYOthrHlNQVLBWhvPHxYiZ3hqmIUC_JcKoNRMm899YiTmhIxAW7MGnGaTS9IsOceYOf_H7UTGj9yQIfVgQK1T5eGOt93jagz9O4i6a1u2nPqzprXB_f_Qwg_tGx79I3YdK0FvuxD_sFZhul7P6nj0Ei4A&sai=AMfl-YQbu9n6xJYB-9QKiC5NGQ0SCIKHFBIFE3JbVVmzpP3g1tuknvOscnKcKYDiFqhwbN241POirPzGKX1G2hbXfAMFBl0TWirVzq-hGg5Zx8F_LIXAoQyK1n1wdKBSfrt5stP9PUZ2zpSfi7CP_uQ8k3Z5GomlYmgg5AmRnhQ&sig=Cg0ArKJSzAGXxYRL2nqbEAE&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=0&cbvp=1&cstd=0&cisv=r20210928.05581&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 03 Oct 2021 02:05:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DF25 41 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 12:36:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 02 Oct 2022 12:36:28 GMT

GET
H2 200 8837003280771501921
s0.2mdn.net/simgad/ Frame DF25 37 KB
38 KB 31ms
7ms Image
image/jpeg 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/8837003280771501921

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4ca2942f239a5329d8f54443d107dbe4aa01ca8634a235aeb585fc0a4ef9e102

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 27 Sep 2021 10:38:31 GMT
x-content-type-options: nosniff
age: 487605
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38290
x-xss-protection: 0
last-modified: Thu, 23 Sep 2021 10:13:08 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Sep 2022 10:38:31 GMT

GET
H/1.1 200
OK 4727t6qteyti Show response
hal9000.redintelligence.net/zone/ Frame 2D17 11 KB
4 KB 60ms
18ms Script
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/4727t6qteyti?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAz_F2w9ZYYaXCdOKrATOsbfgB7XN-YNX_Ni5q-UM8C4QASD7mLVCYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNgBT9AH9yMB-fGDaJg3mAl0B_slEYr7CG2heRfAqBB9hdXz3AuFV4T7jry0nA0yx4q0U57Ie1G1Qxb-vZjcehUSN64bjxBCS8sbPZfIEfCk-gD-tvzV0ybRXpVNel5fQpWJNnruAYj2QuT1ts6B-IY40aprTZdNLgRxu99dM8a9hGolKxABjEzlnaAmY1FAfbdH8fOZ86154QlhIxF2DINgxUglK_8IYKAUYgL3WJgHzNSAua8ZhHaMx9E2af0uIouto98jn1laSeVA0EFu3XGFoV9d9kf53HB5wASqnfy-zwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHfIIG2FkeC1zdWJzeW4tMjcyNzA5ODE1MDg1NzM1MoAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoWgq4v4Rs6wL-ObHvsNp8wFsDPw%26sig%3DAOD64_2P6pKmUqW5zAbFrHqGfKlAAWq12Q%26client%3Dca-pub-9070629843129312%26dbm_c%3DAKAmf-Dfe9V7AWXV6Z1-h3XtrCINFYKCNFC9dHyMq01ba3KOO34nidDGGaPOmoiWoMHsXMvXzgYwkgQaFpfYGGLv9gP_6JfheFPhsL2O37XyaCToF2LXIMje30Ui2Y3bxBZlgNdNY7OHI5uHGKgZzqKPTQbDyRvSRg%26cry%3D1%26dbm_d%3DAKAmf-CaVH8ATKnymx1PPgfIUCbD6aJhLPiUyPcjGBmrZVFu0Qkkctht8jUJ3j6g_ndmmnUeBn47En0tSM5uMFyi-LTqGDDwBraLiKLcGqmLD9rzNCOmYTeLtQPd1sa11fY88jLd49v44lkPKKYr8eGfFX7lb68hLkNbdbnaXgXAELiC8wCQ9nKdqI5rCxyXmdrIY9HHhg2P6fKNxWFwXZbq3_74k-wBxAf-PCWy4G4ZXCrYfPOOb6EAvDlBJfEU6fu4Y7hUdjenHGGKlJkb_2Lc481Gtbq--lj9OPB1N4kUdw_nRWVUtmD284Botx-HWKuVbQmD8PwdIpSSXFHtXBy1m3JKG3OHPEYXckDGDKhfhBGA3VGiyvNo5p6PnkahLTAre5KrT6sVbrvG9vhvlEAKteTTvblvldcHDd7uoYazOIncwcC9ia8iC9juhYNlx4-LBvS-i1j2%26adurl%3D
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 1a8c637863157cd7c92c79ee8b3f9dd638a3ac17b616293a0821db261b2e56b0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:16 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3917
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 2957 22 KB
8 KB 14ms
14ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 02 Oct 2021 12:36:28 GMT
expires: Sun, 02 Oct 2022 12:36:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 48528
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8267 22 KB
8 KB 22ms
12ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 02 Oct 2021 12:36:28 GMT
expires: Sun, 02 Oct 2022 12:36:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 48528
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 96C8 22 KB
8 KB 20ms
13ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 02 Oct 2021 12:36:28 GMT
expires: Sun, 02 Oct 2022 12:36:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 48528
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK z9erfcgupzvd Show response
hal9000.redintelligence.net/zone/ Frame C806 11 KB
4 KB 50ms
18ms Script
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/z9erfcgupzvd?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvgrh2w9ZYYqZCdOKrATOsbfgB7XN-YNX3Ny5q-UM8C4QASCJi8RQYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNkBT9B8eAd0I0cmd_otGEOZqPjngB9vF9cMIJCqu_Cb59GIFyneU6-fjZ7phkGYBRVmjX91EYau2Z5O22Gz9kj6zLs3UfORLtK4jwDCm7UAG55HVqgwOIyd9IIFDPxfKA0vlcQePnV4qtSbEKrAk4zm_p0e3aYtbyy0eStQYnfHlIoKnqX8raq6r9ergMZV1sAPqz6USaLDuGNYD4SAP_xJAGxgCWQeEVkPQk-dROQGqZLIJYGPWtgdMhBKmAt4tMmhWtgMBJ-Vnj9vM6V0iRtIMdTHUJqBjggTQMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoVvJMa5i0-hq4TfPoCUKLrvXMTg%26sig%3DAOD64_2bR_5SmGJCaWruuj3pUfMdipuoog%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-DgTsdfE4F_E7s-0UVymzzgh43c5kaQ8cMRaXg6FAC7ghqJttYSUgCPbMnwL-foxHxP-tjHJApP715SPzmohs9gDbt1iOp1_jlqICXALW-B_bvBxU4JjGPgDEI7jF1axs1vbtlvJXGLpjD3INoaKL1s15pC8w%26cry%3D1%26dbm_d%3DAKAmf-BxWsCfjarA4yvosYIJX_sB5kZvLVaCLRNIGhQ1eNiBhoxiiFf6UJSn1EKOwnJas8HwZUgYBqPEijWFlVKXO5LwSSJVodPn5AcN9YZceUzwk--UDyUj01bVdtBmWn4yh5RuRQfONRI6KYDl4znE2Jh1yQwpu_BXxt_Qsf7z-9A1aAUYv_BGegzpdJ-akPGSpy3WF8zSeCH36KP9tLb-OHugPucGtMqcrQq_GUVUawGtPfgY8zKoxNw3EEECgRBGDxfsoi6uGntnNZ7LPoalbuiNfExAaJmWgBSwMbdXyoKXkeodh3-IzgX4o4wTxyfPcbnmR_FBrVFFKKAJLNScC-h6ofM6uFMDamvzLT7eL86_t1RCyYmGz6bKgd3hcyV8KQwcxPoGl1pNC1wGVjwvo0_Bh94dmjg4YyiPeIvrWofF8n9hgJXxuX0RLoNo-6zQEM54vToi%26adurl%3D
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: 18a0046a8547febf18919c99a88ca17c2bc1b7fe251a9b2e53e0fe12749362c8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:16 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3885
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK 4727t6qteyti Show response
hal9000.redintelligence.net/zone/ Frame 7073 11 KB
4 KB 49ms
17ms Script
text/html 78.46.23.46
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/4727t6qteyti?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC-A0Q2w9ZYZqYCdOKrATOsbfgB7XN-YNX_Ni5q-UM8C4QASCJi8RQYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNgBT9BvACwLgpiVCjAwNaRhp2NwwGu6fc6BJ8afbq0k-9eHDSWCkDUeHo-LLT1D0nNe1f4kzL_eGCvMUySjeuJNm2R9j1KiljaZw6Rbg-ZRWw4NYyzjlc2o2EJGZphi2k0cG7t_DHdcb-Sj_OMjeIFYuBBFgXhT9mZPpcBB5UGMbvmojOFTtmzlg4HVxWySsFhfuTnWqIVTMOj4eMJ-gHqYPWH7DIeKl6X08C0-n-_ZMZ__q2lnBp4tVTFOQuwO5ldMlpJqxSQct_mbX-NP_imVL6rZqn3ZMsCCwASqnfy-zwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7bt7yD_WllkU5vJsnhtKVjgKFw%26sig%3DAOD64_0DKUXOegr5c4Ta2bw55v0ZAMDD-w%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-Du7e0l17RhUxmeVJa_nxVMUyFa5oZ02h2ao1WbJiLE0kmzke_8a12LATq7FHVxtYnecaDfNltT3HcKRfMikZKjjsIHnGCe_VuQQKwY6WmgGsDAExuSb3j7p9DGT5obo9vZtW4dgmegoG7aepRCbUuWM8kwpg%26cry%3D1%26dbm_d%3DAKAmf-BiVS2kUA8GsTH9GhMNOEzDkGQmD9lvKTPoWRwdWBDqoCFhTbNFTHNgDxAvsP9Q-7PokPxlCohDb_PDe07LiSqswFy8oUBUnKVbAiwgzQBQEQ5MNa_kDiR7XX1zjZbpw-Qw9lGJWbRLO4eMhm40kzgBPIJklM_mp9A71jnNzkkU1132Yxk6vmsxn6QNSwLcu4ryLPCE82kjNgrR6j5Qd6hKtV8ZQSWWbC4SDFYY_c_Wb_4_HEv7De9fI5Pw1rbooOyE56ANl1-OccMFLQQ0TSsfiznubQ4qBJMLWK4eMkzDEGci78FSDDpdFtPeqxTV_uzLam2Mp5TkW6938f5fPshYEgBH9s794VIeelaEu_kp7GOeCMrZGFYWnpf5KZBrP8d7_rocDOrtUmqM9TePwv0HpOb-GZMrWQYDGe-hrM0pUGADyX7L6QQySrukhNm6MsIuQT66%26adurl%3D
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.23.46 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.46.23.46.78.clients.your-server.de
Software: Apache /
Resource Hash: d5cb4f34080269b31b61c1a9ca6d29e0beb9c812134405391d14860cd4e3cb1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:16 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3883
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 59AC 41 KB
15 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 12:36:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 02 Oct 2022 12:36:28 GMT

GET
DATA 200
OK truncated
/ Frame 59AC 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3f80c8aac9cc5de47fec8281119cadd601f6173b4664a28a2fed111661544d1c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 801E 41 KB
15 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 12:36:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48528
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 02 Oct 2022 12:36:28 GMT

GET
DATA 200
OK truncated
/ Frame 801E 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a307d781caf468fc613600f9a4b9c62b57917489e8745ecd1d8dd51254ea62f4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0835 22 KB
8 KB 14ms
14ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 02 Oct 2021 12:36:28 GMT
expires: Sun, 02 Oct 2022 12:36:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 48528
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C2A8 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 28a5a6047fa32358acfb298c5c71eae140beb5983a1e16e1015c42cf9aa64e33

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DF25 0
23 B 23ms
22ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C2A8 0
23 B 19ms
19ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sun, 03 Oct 2021 02:05:16 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
DATA 200
OK truncated
/ Frame DF25 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c6065f0c47f0b3bf6ab4fc0e3bfe5ca474447a13959e2effa20e37f65f324783

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

request.php Show response
hal90008.redintelligence.net/ Frame 7073
Redirect Chain

https://hal90008.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=a557462091&subid=&uid=3879a3fa438c999e&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90008.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=a557462091&subid=&uid=3879a3fa438c999e&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

2 KB
1 KB

98ms
73ms

Script
application/x-javascript

138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=a557462091&subid=&uid=3879a3fa438c999e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC-A0Q2w9ZYZqYCdOKrATOsbfgB7XN-YNX_Ni5q-UM8C4QASCJi8RQYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNgBT9BvACwLgpiVCjAwNaRhp2NwwGu6fc6BJ8afbq0k-9eHDSWCkDUeHo-LLT1D0nNe1f4kzL_eGCvMUySjeuJNm2R9j1KiljaZw6Rbg-ZRWw4NYyzjlc2o2EJGZphi2k0cG7t_DHdcb-Sj_OMjeIFYuBBFgXhT9mZPpcBB5UGMbvmojOFTtmzlg4HVxWySsFhfuTnWqIVTMOj4eMJ-gHqYPWH7DIeKl6X08C0-n-_ZMZ__q2lnBp4tVTFOQuwO5ldMlpJqxSQct_mbX-NP_imVL6rZqn3ZMsCCwASqnfy-zwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7bt7yD_WllkU5vJsnhtKVjgKFw%26sig%3DAOD64_0DKUXOegr5c4Ta2bw55v0ZAMDD-w%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-Du7e0l17RhUxmeVJa_nxVMUyFa5oZ02h2ao1WbJiLE0kmzke_8a12LATq7FHVxtYnecaDfNltT3HcKRfMikZKjjsIHnGCe_VuQQKwY6WmgGsDAExuSb3j7p9DGT5obo9vZtW4dgmegoG7aepRCbUuWM8kwpg%26cry%3D1%26dbm_d%3DAKAmf-BiVS2kUA8GsTH9GhMNOEzDkGQmD9lvKTPoWRwdWBDqoCFhTbNFTHNgDxAvsP9Q-7PokPxlCohDb_PDe07LiSqswFy8oUBUnKVbAiwgzQBQEQ5MNa_kDiR7XX1zjZbpw-Qw9lGJWbRLO4eMhm40kzgBPIJklM_mp9A71jnNzkkU1132Yxk6vmsxn6QNSwLcu4ryLPCE82kjNgrR6j5Qd6hKtV8ZQSWWbC4SDFYY_c_Wb_4_HEv7De9fI5Pw1rbooOyE56ANl1-OccMFLQQ0TSsfiznubQ4qBJMLWK4eMkzDEGci78FSDDpdFtPeqxTV_uzLam2Mp5TkW6938f5fPshYEgBH9s794VIeelaEu_kp7GOeCMrZGFYWnpf5KZBrP8d7_rocDOrtUmqM9TePwv0HpOb-GZMrWQYDGe-hrM0pUGADyX7L6QQySrukhNm6MsIuQT66%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=3110944309557&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: acd139f49138bc389e159ad7acb6c09ca65e17e2d412ba6240dbb4826f61b473

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 38331900017250100710612011736008
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 894
Expires: Sun, 03 Oct 2021 03:05:16 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=a557462091&subid=&uid=3879a3fa438c999e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC-A0Q2w9ZYZqYCdOKrATOsbfgB7XN-YNX_Ni5q-UM8C4QASCJi8RQYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNgBT9BvACwLgpiVCjAwNaRhp2NwwGu6fc6BJ8afbq0k-9eHDSWCkDUeHo-LLT1D0nNe1f4kzL_eGCvMUySjeuJNm2R9j1KiljaZw6Rbg-ZRWw4NYyzjlc2o2EJGZphi2k0cG7t_DHdcb-Sj_OMjeIFYuBBFgXhT9mZPpcBB5UGMbvmojOFTtmzlg4HVxWySsFhfuTnWqIVTMOj4eMJ-gHqYPWH7DIeKl6X08C0-n-_ZMZ__q2lnBp4tVTFOQuwO5ldMlpJqxSQct_mbX-NP_imVL6rZqn3ZMsCCwASqnfy-zwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7bt7yD_WllkU5vJsnhtKVjgKFw%26sig%3DAOD64_0DKUXOegr5c4Ta2bw55v0ZAMDD-w%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-Du7e0l17RhUxmeVJa_nxVMUyFa5oZ02h2ao1WbJiLE0kmzke_8a12LATq7FHVxtYnecaDfNltT3HcKRfMikZKjjsIHnGCe_VuQQKwY6WmgGsDAExuSb3j7p9DGT5obo9vZtW4dgmegoG7aepRCbUuWM8kwpg%26cry%3D1%26dbm_d%3DAKAmf-BiVS2kUA8GsTH9GhMNOEzDkGQmD9lvKTPoWRwdWBDqoCFhTbNFTHNgDxAvsP9Q-7PokPxlCohDb_PDe07LiSqswFy8oUBUnKVbAiwgzQBQEQ5MNa_kDiR7XX1zjZbpw-Qw9lGJWbRLO4eMhm40kzgBPIJklM_mp9A71jnNzkkU1132Yxk6vmsxn6QNSwLcu4ryLPCE82kjNgrR6j5Qd6hKtV8ZQSWWbC4SDFYY_c_Wb_4_HEv7De9fI5Pw1rbooOyE56ANl1-OccMFLQQ0TSsfiznubQ4qBJMLWK4eMkzDEGci78FSDDpdFtPeqxTV_uzLam2Mp5TkW6938f5fPshYEgBH9s794VIeelaEu_kp7GOeCMrZGFYWnpf5KZBrP8d7_rocDOrtUmqM9TePwv0HpOb-GZMrWQYDGe-hrM0pUGADyX7L6QQySrukhNm6MsIuQT66%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=3110944309557&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Sun, 03 Oct 2021 03:05:16 +0200

GET
H/1.1

200
OK

request.php Show response
hal90009.redintelligence.net/ Frame 2D17
Redirect Chain

https://hal90009.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=9120c53a3d&subid=&uid=155b92a31831a94d&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90009.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=9120c53a3d&subid=&uid=155b92a31831a94d&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

2 KB
1 KB

96ms
72ms

Script
application/x-javascript

138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=9120c53a3d&subid=&uid=155b92a31831a94d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAz_F2w9ZYYaXCdOKrATOsbfgB7XN-YNX_Ni5q-UM8C4QASD7mLVCYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNgBT9AH9yMB-fGDaJg3mAl0B_slEYr7CG2heRfAqBB9hdXz3AuFV4T7jry0nA0yx4q0U57Ie1G1Qxb-vZjcehUSN64bjxBCS8sbPZfIEfCk-gD-tvzV0ybRXpVNel5fQpWJNnruAYj2QuT1ts6B-IY40aprTZdNLgRxu99dM8a9hGolKxABjEzlnaAmY1FAfbdH8fOZ86154QlhIxF2DINgxUglK_8IYKAUYgL3WJgHzNSAua8ZhHaMx9E2af0uIouto98jn1laSeVA0EFu3XGFoV9d9kf53HB5wASqnfy-zwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHfIIG2FkeC1zdWJzeW4tMjcyNzA5ODE1MDg1NzM1MoAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoWgq4v4Rs6wL-ObHvsNp8wFsDPw%26sig%3DAOD64_2P6pKmUqW5zAbFrHqGfKlAAWq12Q%26client%3Dca-pub-9070629843129312%26dbm_c%3DAKAmf-Dfe9V7AWXV6Z1-h3XtrCINFYKCNFC9dHyMq01ba3KOO34nidDGGaPOmoiWoMHsXMvXzgYwkgQaFpfYGGLv9gP_6JfheFPhsL2O37XyaCToF2LXIMje30Ui2Y3bxBZlgNdNY7OHI5uHGKgZzqKPTQbDyRvSRg%26cry%3D1%26dbm_d%3DAKAmf-CaVH8ATKnymx1PPgfIUCbD6aJhLPiUyPcjGBmrZVFu0Qkkctht8jUJ3j6g_ndmmnUeBn47En0tSM5uMFyi-LTqGDDwBraLiKLcGqmLD9rzNCOmYTeLtQPd1sa11fY88jLd49v44lkPKKYr8eGfFX7lb68hLkNbdbnaXgXAELiC8wCQ9nKdqI5rCxyXmdrIY9HHhg2P6fKNxWFwXZbq3_74k-wBxAf-PCWy4G4ZXCrYfPOOb6EAvDlBJfEU6fu4Y7hUdjenHGGKlJkb_2Lc481Gtbq--lj9OPB1N4kUdw_nRWVUtmD284Botx-HWKuVbQmD8PwdIpSSXFHtXBy1m3JKG3OHPEYXckDGDKhfhBGA3VGiyvNo5p6PnkahLTAre5KrT6sVbrvG9vhvlEAKteTTvblvldcHDd7uoYazOIncwcC9ia8iC9juhYNlx4-LBvS-i1j2%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=5635054115187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 91c2ee2c88318d4c2976414db6bc036fcfa537f0ad54a735022c4f23ecdcb806

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 46866900014082500710612011736009
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 892
Expires: Sun, 03 Oct 2021 03:05:16 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=9120c53a3d&subid=&uid=155b92a31831a94d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAz_F2w9ZYYaXCdOKrATOsbfgB7XN-YNX_Ni5q-UM8C4QASD7mLVCYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNgBT9AH9yMB-fGDaJg3mAl0B_slEYr7CG2heRfAqBB9hdXz3AuFV4T7jry0nA0yx4q0U57Ie1G1Qxb-vZjcehUSN64bjxBCS8sbPZfIEfCk-gD-tvzV0ybRXpVNel5fQpWJNnruAYj2QuT1ts6B-IY40aprTZdNLgRxu99dM8a9hGolKxABjEzlnaAmY1FAfbdH8fOZ86154QlhIxF2DINgxUglK_8IYKAUYgL3WJgHzNSAua8ZhHaMx9E2af0uIouto98jn1laSeVA0EFu3XGFoV9d9kf53HB5wASqnfy-zwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHfIIG2FkeC1zdWJzeW4tMjcyNzA5ODE1MDg1NzM1MoAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoWgq4v4Rs6wL-ObHvsNp8wFsDPw%26sig%3DAOD64_2P6pKmUqW5zAbFrHqGfKlAAWq12Q%26client%3Dca-pub-9070629843129312%26dbm_c%3DAKAmf-Dfe9V7AWXV6Z1-h3XtrCINFYKCNFC9dHyMq01ba3KOO34nidDGGaPOmoiWoMHsXMvXzgYwkgQaFpfYGGLv9gP_6JfheFPhsL2O37XyaCToF2LXIMje30Ui2Y3bxBZlgNdNY7OHI5uHGKgZzqKPTQbDyRvSRg%26cry%3D1%26dbm_d%3DAKAmf-CaVH8ATKnymx1PPgfIUCbD6aJhLPiUyPcjGBmrZVFu0Qkkctht8jUJ3j6g_ndmmnUeBn47En0tSM5uMFyi-LTqGDDwBraLiKLcGqmLD9rzNCOmYTeLtQPd1sa11fY88jLd49v44lkPKKYr8eGfFX7lb68hLkNbdbnaXgXAELiC8wCQ9nKdqI5rCxyXmdrIY9HHhg2P6fKNxWFwXZbq3_74k-wBxAf-PCWy4G4ZXCrYfPOOb6EAvDlBJfEU6fu4Y7hUdjenHGGKlJkb_2Lc481Gtbq--lj9OPB1N4kUdw_nRWVUtmD284Botx-HWKuVbQmD8PwdIpSSXFHtXBy1m3JKG3OHPEYXckDGDKhfhBGA3VGiyvNo5p6PnkahLTAre5KrT6sVbrvG9vhvlEAKteTTvblvldcHDd7uoYazOIncwcC9ia8iC9juhYNlx4-LBvS-i1j2%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=5635054115187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Sun, 03 Oct 2021 03:05:16 +0200

GET
H/1.1

200
OK

request.php Show response
hal900024.redintelligence.net/ Frame C806
Redirect Chain

https://hal900024.redintelligence.net/request.php?zone=z9erfcgupzvd&nw=20&renderingType=javascript&namespace=476a196b59&subid=&uid=e0b671838f6f36d9&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900024.redintelligence.net/request.php?zone=z9erfcgupzvd&nw=20&renderingType=javascript&namespace=476a196b59&subid=&uid=e0b671838f6f36d9&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

2 KB
1 KB

122ms
98ms

Script
application/x-javascript

138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request.php?zone=z9erfcgupzvd&nw=20&renderingType=javascript&namespace=476a196b59&subid=&uid=e0b671838f6f36d9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvgrh2w9ZYYqZCdOKrATOsbfgB7XN-YNX3Ny5q-UM8C4QASCJi8RQYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNkBT9B8eAd0I0cmd_otGEOZqPjngB9vF9cMIJCqu_Cb59GIFyneU6-fjZ7phkGYBRVmjX91EYau2Z5O22Gz9kj6zLs3UfORLtK4jwDCm7UAG55HVqgwOIyd9IIFDPxfKA0vlcQePnV4qtSbEKrAk4zm_p0e3aYtbyy0eStQYnfHlIoKnqX8raq6r9ergMZV1sAPqz6USaLDuGNYD4SAP_xJAGxgCWQeEVkPQk-dROQGqZLIJYGPWtgdMhBKmAt4tMmhWtgMBJ-Vnj9vM6V0iRtIMdTHUJqBjggTQMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoVvJMa5i0-hq4TfPoCUKLrvXMTg%26sig%3DAOD64_2bR_5SmGJCaWruuj3pUfMdipuoog%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-DgTsdfE4F_E7s-0UVymzzgh43c5kaQ8cMRaXg6FAC7ghqJttYSUgCPbMnwL-foxHxP-tjHJApP715SPzmohs9gDbt1iOp1_jlqICXALW-B_bvBxU4JjGPgDEI7jF1axs1vbtlvJXGLpjD3INoaKL1s15pC8w%26cry%3D1%26dbm_d%3DAKAmf-BxWsCfjarA4yvosYIJX_sB5kZvLVaCLRNIGhQ1eNiBhoxiiFf6UJSn1EKOwnJas8HwZUgYBqPEijWFlVKXO5LwSSJVodPn5AcN9YZceUzwk--UDyUj01bVdtBmWn4yh5RuRQfONRI6KYDl4znE2Jh1yQwpu_BXxt_Qsf7z-9A1aAUYv_BGegzpdJ-akPGSpy3WF8zSeCH36KP9tLb-OHugPucGtMqcrQq_GUVUawGtPfgY8zKoxNw3EEECgRBGDxfsoi6uGntnNZ7LPoalbuiNfExAaJmWgBSwMbdXyoKXkeodh3-IzgX4o4wTxyfPcbnmR_FBrVFFKKAJLNScC-h6ofM6uFMDamvzLT7eL86_t1RCyYmGz6bKgd3hcyV8KQwcxPoGl1pNC1wGVjwvo0_Bh94dmjg4YyiPeIvrWofF8n9hgJXxuX0RLoNo-6zQEM54vToi%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=9536248076431&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d86e293458bc3d56aa84b47e9c46ac874e5100126bdde1f7114c6f4a3fa7fc08

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 36111600011303800710618011736024
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 895
Expires: Sun, 03 Oct 2021 03:05:16 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=z9erfcgupzvd&nw=20&renderingType=javascript&namespace=476a196b59&subid=&uid=e0b671838f6f36d9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvgrh2w9ZYYqZCdOKrATOsbfgB7XN-YNX3Ny5q-UM8C4QASCJi8RQYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNkBT9B8eAd0I0cmd_otGEOZqPjngB9vF9cMIJCqu_Cb59GIFyneU6-fjZ7phkGYBRVmjX91EYau2Z5O22Gz9kj6zLs3UfORLtK4jwDCm7UAG55HVqgwOIyd9IIFDPxfKA0vlcQePnV4qtSbEKrAk4zm_p0e3aYtbyy0eStQYnfHlIoKnqX8raq6r9ergMZV1sAPqz6USaLDuGNYD4SAP_xJAGxgCWQeEVkPQk-dROQGqZLIJYGPWtgdMhBKmAt4tMmhWtgMBJ-Vnj9vM6V0iRtIMdTHUJqBjggTQMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoVvJMa5i0-hq4TfPoCUKLrvXMTg%26sig%3DAOD64_2bR_5SmGJCaWruuj3pUfMdipuoog%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-DgTsdfE4F_E7s-0UVymzzgh43c5kaQ8cMRaXg6FAC7ghqJttYSUgCPbMnwL-foxHxP-tjHJApP715SPzmohs9gDbt1iOp1_jlqICXALW-B_bvBxU4JjGPgDEI7jF1axs1vbtlvJXGLpjD3INoaKL1s15pC8w%26cry%3D1%26dbm_d%3DAKAmf-BxWsCfjarA4yvosYIJX_sB5kZvLVaCLRNIGhQ1eNiBhoxiiFf6UJSn1EKOwnJas8HwZUgYBqPEijWFlVKXO5LwSSJVodPn5AcN9YZceUzwk--UDyUj01bVdtBmWn4yh5RuRQfONRI6KYDl4znE2Jh1yQwpu_BXxt_Qsf7z-9A1aAUYv_BGegzpdJ-akPGSpy3WF8zSeCH36KP9tLb-OHugPucGtMqcrQq_GUVUawGtPfgY8zKoxNw3EEECgRBGDxfsoi6uGntnNZ7LPoalbuiNfExAaJmWgBSwMbdXyoKXkeodh3-IzgX4o4wTxyfPcbnmR_FBrVFFKKAJLNScC-h6ofM6uFMDamvzLT7eL86_t1RCyYmGz6bKgd3hcyV8KQwcxPoGl1pNC1wGVjwvo0_Bh94dmjg4YyiPeIvrWofF8n9hgJXxuX0RLoNo-6zQEM54vToi%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=9536248076431&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Sun, 03 Oct 2021 03:05:16 +0200

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 56A8 22 KB
8 KB 15ms
14ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 02 Oct 2021 12:36:28 GMT
expires: Sun, 02 Oct 2022 12:36:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 48528
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame EB34 22 KB
8 KB 14ms
14ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 02 Oct 2021 12:36:28 GMT
expires: Sun, 02 Oct 2022 12:36:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 48528
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/12728553930114966770/ Frame 9B3F 78 KB
19 KB 310ms
8ms Document
text/html 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/12728553930114966770/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3ac1b03691e7e0db51bd7e8a0c47cfd770995766bf032772576516389abf8166

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /sadbundle/12728553930114966770/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Mon, 27 Sep 2021 05:03:35 GMT
expires: Tue, 27 Sep 2022 05:03:35 GMT
last-modified: Tue, 01 Sep 2020 21:12:09 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
content-length: 19640
age: 507701
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 59AC 0
24 B 39ms
38ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuHA4qF2wfOQvuhd3sqdquZAOkVfQMgg2lX_x9ceqvpdQb-PQ4eAie96s3j9oJ7qaoswUTfahh9__gotj1xugrRtwq4eAZa2Rz0f2vdFWKTrIExOuZTGeHhnWInEnNibGC8irE_ryIHOleGrtApjXjcK6vJaw43eT1p0Rr-gU7r3-Sgdv86tJnjXcq2Vt9xBHe91BCYd9bIV90ckfOq_xw0L-yip2_fDM6h4HjqbywenaOAAKUfpBskDp5rvkJnkf2R4oaqzvoRqLB7hR4AlfnGkxSMzYDlS_AtujR5CN6wlRunx7jTVQENvvBeSQNgvOb1K3XMyCVVxvZ2wLWuriNm7fFpdNi9p_O07NMlyjHjmtXE_5Sc-QjMrnrrLg0gr9NXpAa8WzzE7P_ZHmGUFUWBngXCS0zpUeQnC9RPtziYuLkOq6rjG2fX4vEfE75un5NJEFpNFImiDg4B0HZcdRoW5_eutVr4qI0ybkqkLsW_MP4f9mECVqxKevYyZYp9ODDAn4KDd_d78XcqKT3ZDLFz560Lt9877GXBA_-GGY_VRIbIb0J-msJYOJ-5x80skgC9pv7erFWY4CzXK-QY9ca1OIY82CxUHDoSkrIJu4APqQEqEPUapTxR3H-gclt4KV7okBK1b4hRh1PxzUQ-beJJw7IRzFm2d9_qgqfEh8kVGIkOSdbKC5tNbrUs-AGKyQ3G70KosjogMO_bjH_v_Wbyh56sRJ5XRtO0xV88rvIZeKt8Plt0VshU_WjCKg_Gia4IJLmMG5Bhho1bvB0ULdi5Juk5-hPn3hKfwhPMor9EUzw1NMXeIU4N8BEKxE3ESda5XdRBYribJchnIHJLcYQGGJ707rMkDZawO8YPX-Q93VFfJ9VQiz_opV8nPe9PGa1kEn10ovFtZd9Ht8g1IqCPGLOoZvLmwoYYzvM9LJc15XhxzNWP0yf02asc1-w-LTBj8ZBtXMHw72qKWnD9cvN0NKecmg9_HHfETPc59ZFcR3aP1BxkLryjyJjPI64CxMTsSbHkRhIloucoI44EE3NHqhEp6Hiss8uLFAlnAZ1AqgOZ_e0ix6bUGioyluLHaV1rL9mSsDILWxHwThdl3w&sai=AMfl-YQYQqxCDNu9d4_l9K1PCiVPB3JoOykAuhtf562cKTCRV1PUnbzsqgKDrotjULiDzOsO3uqdeE-IKkjwWV_RVxDmCRuthz4tNfu_6i-vAYJfRLj47t0ZphojuCvN8qrOjjNN4JmxCS-1neLmGfkotG4EQA3k_WZrgMSeYGA&sig=Cg0ArKJSzGFaYa6vRy-DEAE&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=195&cbvp=1&cstd=192&cisv=r20210928.34187&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 03 Oct 2021 02:05:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E083 22 KB
8 KB 15ms
14ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Sat, 02 Oct 2021 12:36:28 GMT
expires: Sun, 02 Oct 2022 12:36:28 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 48528
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK mtrcs_220434.js Show response
s79.mxcdn.net/bb-mx/serve/ Frame 801E 148 KB
57 KB 333ms
29ms Script
text/javascript 2.18.233.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-67.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 8943b798efddc7a5ee242732dd0cb2f7f4d5c59417a97b3da42eae595bddf270

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:16 GMT
Content-Encoding: gzip
Last-Modified: Mon, 27 Sep 2021 08:58:23 GMT
Server: nginx
ETag: "\W00000580191632733103776"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI COM NAV STA"
Cache-Control: public, max-age=1800
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 58019
Expires: Sun, 03 Oct 2021 02:35:16 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/ Frame F260 6 KB
2 KB 290ms
8ms Document
text/html 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f89afa533ee24b3e3e335bc5c0660e1c89d95e0fa11beca8da9fc8862a221ef4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 1913
date: Sat, 02 Oct 2021 11:55:24 GMT
expires: Sun, 03 Oct 2021 11:55:24 GMT
last-modified: Mon, 27 Sep 2021 15:27:49 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 50992
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 801E 0
24 B 41ms
40ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvrRUPOxyXAyNwx40QM1hfRsRYv9Nqrii9F4GWJrI3yjTVhwVn5TxVzIuNqpiwm6TqudAsstxPRpd45eKYrCNnqPh7vbtIU1zXjCAj1nETTYesyhkhF6yqR1vxyCDhwIldATFdTWqA2sox6pHbHfeD5Qs11CV4IQJKY-s47PZqWDlFgLkPN3QhI8sSzI5gS9HtrnTLhbk0FWaNbosWY7ZRp1bZ18XttSjDYSZEHUWURu-qncRnaLoDxSumj4i9vLk_XjWE0vjiltgJXslxpAXAqFyk5a-MFLpzZJL8IO-XOl4xRkRDOgEhnRE_PDBoGF2O42R45ph-YH7BgHdH0tS-p23kcgcWh1z2wCCTsnI6fRKt4pe0v4U0ETT7-AOgewZT8jvLOXOH8nHOv2j55lHry8hIUwqq3uorVqJhR3KloHYiQmQfjefr1oKUrvr-kb3IiP1WgY_iGwqjflsKceMmCtYJBg2s2T223U9RfR20rlbqkJdnNG39nihlCB2Fi9ir3-u78i5QBsuzcHKvunIaMdcmKvGzh8PpTlLv6LzcwlRFMhGZmsuI7gp5t_kkx92xN0I6ATKkrjpuJti0GY4Ii4zRlWvn1zpXiyZ0Z_texHNJFxUbVx1JuRHpSrejyJyEgtqiJDruRxOJPOze-_1TDOFNHBYyc_-7kqkS6-qtFCXhntIgvRaiHYGBhCfxQz7_hPYq8CsRoBvGIQKsmWo-uytNsGaLnuSk7vkN36CQLHlgt3W_vIxvKcFKCFBmKcuM3x0q5X8M5Nt-6WMWk9cpBFwD0w_byPIXAAX3tzFqxa91mnMoaApQl0iB2hIR1tklECrlmi-TEDKLgoadJF0dV6gyhXmJpHuTBaGk9An2ODdd0-mnxcYiS7JdEriLpfOpl7sO8WZEOwgvWuj5hHlNkF8cqjLDo_xCJhDe7CGsHK6gS-7BRwtdmbYOMopuxolyEL6LnvIr0gT969BXOfX1YYHcw1TEo8V-LQFny0NU_VZOmDGTz5WBurNDw57ALllxL99hKLP_bP5rNb_DWTVwFWH0b8J5Xfm6zVj8zdVYMPfh0A8RmiKlKNgpIbZ8VwAh9CT60O3fxe80N8RRtzvgK_IEjtHgRUCy3bg5dSS3RFzQhaOsJsDCwC8zG4uHuVkc1fBeP6hXnUDlEFLF_4xVIT0IWUYACKKx8mnbajc0lQXUiMCiV&sai=AMfl-YTcCTVSW9PsFlJtzXB-eE57Rl_RNxjYrYi2IPS3T54xiZGTTRdjs4UupPezmXpf5pJ60J7ciYzsK63SjMZZFC5NB4yxPzHxBQ07f9Chbzg1bzn6TodUZrhifKN648dbWr7GHca3TpXAZyTKNmDIOq5AbkGa8ND6Qjpf-uY&sig=Cg0ArKJSzMihT-nsV_AsEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=204&cbvp=1&cstd=203&cisv=r20210928.79993&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Sun, 03 Oct 2021 02:05:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js Show response
pagead2.googlesyndication.com/bg/ Frame 2957 35 KB
13 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9d3fd1f2686390c9a4a63870971c6b933745815caa2d262ae198d42c12a8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:14:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13373
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 15:14:50 GMT

GET
H2 200 D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js Show response
pagead2.googlesyndication.com/bg/ Frame 8267 35 KB
13 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9d3fd1f2686390c9a4a63870971c6b933745815caa2d262ae198d42c12a8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:14:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13373
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 15:14:50 GMT

GET
H2 200 D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js Show response
pagead2.googlesyndication.com/bg/ Frame 96C8 35 KB
13 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9d3fd1f2686390c9a4a63870971c6b933745815caa2d262ae198d42c12a8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:14:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13373
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 15:14:50 GMT

GET
H2 200 D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js Show response
pagead2.googlesyndication.com/bg/ Frame 0835 35 KB
13 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9d3fd1f2686390c9a4a63870971c6b933745815caa2d262ae198d42c12a8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:14:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13373
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 15:14:50 GMT

GET
H2 200 D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js Show response
pagead2.googlesyndication.com/bg/ Frame 56A8 35 KB
13 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9d3fd1f2686390c9a4a63870971c6b933745815caa2d262ae198d42c12a8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:14:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13373
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 15:14:50 GMT

GET
H2 200 D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js Show response
pagead2.googlesyndication.com/bg/ Frame EB34 35 KB
13 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9d3fd1f2686390c9a4a63870971c6b933745815caa2d262ae198d42c12a8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:14:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13373
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 15:14:50 GMT

GET
H2 200 D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js Show response
pagead2.googlesyndication.com/bg/ Frame E083 35 KB
13 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/D50_0fJoY5DJpKY4cJcca5M3RYFcqi0mKuGY1CwSqLI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0f9d3fd1f2686390c9a4a63870971c6b933745815caa2d262ae198d42c12a8b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 15:14:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 125426
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13373
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sat, 01 Oct 2022 15:14:50 GMT

GET
H3

200

activityi;dc_pre=CNm1t9KTrfMCFX7TEQgdFycMoQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105 Show response
5994599.fls.doubleclick.net/ Frame F759
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CNm1t9KTrfMCFX7TEQgdFycMoQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105?

392 B
345 B

46ms
31ms

Document
text/html

142.250.185.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CNm1t9KTrfMCFX7TEQgdFycMoQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105?

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f6.1e100.net

Software

cafe /

Resource Hash

370db009516c215c8d20dcbdca30dcd0345fefdde06f3d2eb8795c5cf8be2928

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CNm1t9KTrfMCFX7TEQgdFycMoQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnaHXp9vK9lAqiTwWc_-4HmxE5YAawCoCUG2jeUOCsYeLT7PikOm97gep3vqeE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 03 Oct 2021 02:05:17 GMT
expires: Sun, 03 Oct 2021 02:05:17 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 322
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 03 Oct 2021 02:05:16 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNm1t9KTrfMCFX7TEQgdFycMoQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal90009.redintelligence.net/ Frame B5BE 4 KB
2 KB 36ms
12ms Document
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request_content.php?s=46866900014082500710612011736009&a=6fbf389e
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=9120c53a3d&subid=&uid=155b92a31831a94d&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCAz_F2w9ZYYaXCdOKrATOsbfgB7XN-YNX_Ni5q-UM8C4QASD7mLVCYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNgBT9AH9yMB-fGDaJg3mAl0B_slEYr7CG2heRfAqBB9hdXz3AuFV4T7jry0nA0yx4q0U57Ie1G1Qxb-vZjcehUSN64bjxBCS8sbPZfIEfCk-gD-tvzV0ybRXpVNel5fQpWJNnruAYj2QuT1ts6B-IY40aprTZdNLgRxu99dM8a9hGolKxABjEzlnaAmY1FAfbdH8fOZ86154QlhIxF2DINgxUglK_8IYKAUYgL3WJgHzNSAua8ZhHaMx9E2af0uIouto98jn1laSeVA0EFu3XGFoV9d9kf53HB5wASqnfy-zwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHfIIG2FkeC1zdWJzeW4tMjcyNzA5ODE1MDg1NzM1MoAKA5gLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRoWgq4v4Rs6wL-ObHvsNp8wFsDPw%26sig%3DAOD64_2P6pKmUqW5zAbFrHqGfKlAAWq12Q%26client%3Dca-pub-9070629843129312%26dbm_c%3DAKAmf-Dfe9V7AWXV6Z1-h3XtrCINFYKCNFC9dHyMq01ba3KOO34nidDGGaPOmoiWoMHsXMvXzgYwkgQaFpfYGGLv9gP_6JfheFPhsL2O37XyaCToF2LXIMje30Ui2Y3bxBZlgNdNY7OHI5uHGKgZzqKPTQbDyRvSRg%26cry%3D1%26dbm_d%3DAKAmf-CaVH8ATKnymx1PPgfIUCbD6aJhLPiUyPcjGBmrZVFu0Qkkctht8jUJ3j6g_ndmmnUeBn47En0tSM5uMFyi-LTqGDDwBraLiKLcGqmLD9rzNCOmYTeLtQPd1sa11fY88jLd49v44lkPKKYr8eGfFX7lb68hLkNbdbnaXgXAELiC8wCQ9nKdqI5rCxyXmdrIY9HHhg2P6fKNxWFwXZbq3_74k-wBxAf-PCWy4G4ZXCrYfPOOb6EAvDlBJfEU6fu4Y7hUdjenHGGKlJkb_2Lc481Gtbq--lj9OPB1N4kUdw_nRWVUtmD284Botx-HWKuVbQmD8PwdIpSSXFHtXBy1m3JKG3OHPEYXckDGDKhfhBGA3VGiyvNo5p6PnkahLTAre5KrT6sVbrvG9vhvlEAKteTTvblvldcHDd7uoYazOIncwcC9ia8iC9juhYNlx4-LBvS-i1j2%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=5635054115187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f498b7a1874565dafa015af18e2df2ecc2cafcb9a61aab170df499d1cc350af4

Request headers

Host: hal90009.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=0549ed6c0a447f72
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Sun, 03 Oct 2021 03:05:16 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1524
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame 2D17 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8b9d6b7df075948a37cd2edd94481df59499bfe1b3ea2ce490abf20626fbd6a0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

activityi;dc_pre=CIP0t9KTrfMCFUaB3godt2EKTg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348 Show response
5994599.fls.doubleclick.net/ Frame 5773
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CIP0t9KTrfMCFUaB3godt2EKTg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348?

391 B
344 B

32ms
24ms

Document
text/html

142.250.185.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CIP0t9KTrfMCFUaB3godt2EKTg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348?

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f6.1e100.net

Software

cafe /

Resource Hash

4deaa5158b58faeb0356eb72f9bacf084f8d05d627aec07f25046e7eae4a329c

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CIP0t9KTrfMCFUaB3godt2EKTg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnaHXp9vK9lAqiTwWc_-4HmxE5YAawCoCUG2jeUOCsYeLT7PikOm97gep3vqeE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 03 Oct 2021 02:05:17 GMT
expires: Sun, 03 Oct 2021 02:05:17 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 321
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 03 Oct 2021 02:05:17 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIP0t9KTrfMCFUaB3godt2EKTg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal90008.redintelligence.net/ Frame ACA9 7 KB
3 KB 37ms
13ms Document
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/request_content.php?s=38331900017250100710612011736008&a=1460fcb6
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=a557462091&subid=&uid=3879a3fa438c999e&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC-A0Q2w9ZYZqYCdOKrATOsbfgB7XN-YNX_Ni5q-UM8C4QASCJi8RQYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNgBT9BvACwLgpiVCjAwNaRhp2NwwGu6fc6BJ8afbq0k-9eHDSWCkDUeHo-LLT1D0nNe1f4kzL_eGCvMUySjeuJNm2R9j1KiljaZw6Rbg-ZRWw4NYyzjlc2o2EJGZphi2k0cG7t_DHdcb-Sj_OMjeIFYuBBFgXhT9mZPpcBB5UGMbvmojOFTtmzlg4HVxWySsFhfuTnWqIVTMOj4eMJ-gHqYPWH7DIeKl6X08C0-n-_ZMZ__q2lnBp4tVTFOQuwO5ldMlpJqxSQct_mbX-NP_imVL6rZqn3ZMsCCwASqnfy-zwHgBAOQBgGgBk2AB-vn6F6oB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4bqAfz0RuoB5bYG6gHqpuxAqgH35-xAtgHANIICQiI4YAQEAEYHYAKAZgLAcgLAYAMAbATwpraCtATANgTA9gUAdAVAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAASFeRo7bt7yD_WllkU5vJsnhtKVjgKFw%26sig%3DAOD64_0DKUXOegr5c4Ta2bw55v0ZAMDD-w%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-Du7e0l17RhUxmeVJa_nxVMUyFa5oZ02h2ao1WbJiLE0kmzke_8a12LATq7FHVxtYnecaDfNltT3HcKRfMikZKjjsIHnGCe_VuQQKwY6WmgGsDAExuSb3j7p9DGT5obo9vZtW4dgmegoG7aepRCbUuWM8kwpg%26cry%3D1%26dbm_d%3DAKAmf-BiVS2kUA8GsTH9GhMNOEzDkGQmD9lvKTPoWRwdWBDqoCFhTbNFTHNgDxAvsP9Q-7PokPxlCohDb_PDe07LiSqswFy8oUBUnKVbAiwgzQBQEQ5MNa_kDiR7XX1zjZbpw-Qw9lGJWbRLO4eMhm40kzgBPIJklM_mp9A71jnNzkkU1132Yxk6vmsxn6QNSwLcu4ryLPCE82kjNgrR6j5Qd6hKtV8ZQSWWbC4SDFYY_c_Wb_4_HEv7De9fI5Pw1rbooOyE56ANl1-OccMFLQQ0TSsfiznubQ4qBJMLWK4eMkzDEGci78FSDDpdFtPeqxTV_uzLam2Mp5TkW6938f5fPshYEgBH9s794VIeelaEu_kp7GOeCMrZGFYWnpf5KZBrP8d7_rocDOrtUmqM9TePwv0HpOb-GZMrWQYDGe-hrM0pUGADyX7L6QQySrukhNm6MsIuQT66%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=3110944309557&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1e60dd2b9e519dfc76b4e784559a1d90a6d1c40bb6a20d100d341ff07dc9a103

Request headers

Host: hal90008.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=0549ed6c0a447f72
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Sun, 03 Oct 2021 03:05:16 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2319
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame 7073 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 66eb9c7bdd6f35e832d8dd41c130119d42ec71212e3c02967d5c32134abc2153

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

activityi;dc_pre=CLT4t9KTrfMCFd134Aodx3ANuQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266 Show response
5994599.fls.doubleclick.net/ Frame 6CC4
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CLT4t9KTrfMCFd134Aodx3ANuQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266?

392 B
346 B

147ms
140ms

Document
text/html

142.250.185.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CLT4t9KTrfMCFd134Aodx3ANuQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266?

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f6.1e100.net

Software

cafe /

Resource Hash

d0e0fbf7f790d28980c839b6e0dde2c47e57ad21beac87e386c4ab6b02e19a04

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CLT4t9KTrfMCFd134Aodx3ANuQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnaHXp9vK9lAqiTwWc_-4HmxE5YAawCoCUG2jeUOCsYeLT7PikOm97gep3vqeE
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 03 Oct 2021 02:05:17 GMT
expires: Sun, 03 Oct 2021 02:05:17 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 323
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 03 Oct 2021 02:05:17 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLT4t9KTrfMCFd134Aodx3ANuQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900024.redintelligence.net/ Frame 55CC 4 KB
2 KB 40ms
16ms Document
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request_content.php?s=36111600011303800710618011736024&a=3bfbadd0
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=z9erfcgupzvd&nw=20&renderingType=javascript&namespace=476a196b59&subid=&uid=e0b671838f6f36d9&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=160x600&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCvgrh2w9ZYYqZCdOKrATOsbfgB7XN-YNX3Ny5q-UM8C4QASCJi8RQYJX68IGMB8gBCakCLPN3MWJzsz6oAwGqBNkBT9B8eAd0I0cmd_otGEOZqPjngB9vF9cMIJCqu_Cb59GIFyneU6-fjZ7phkGYBRVmjX91EYau2Z5O22Gz9kj6zLs3UfORLtK4jwDCm7UAG55HVqgwOIyd9IIFDPxfKA0vlcQePnV4qtSbEKrAk4zm_p0e3aYtbyy0eStQYnfHlIoKnqX8raq6r9ergMZV1sAPqz6USaLDuGNYD4SAP_xJAGxgCWQeEVkPQk-dROQGqZLIJYGPWtgdMhBKmAt4tMmhWtgMBJ-Vnj9vM6V0iRtIMdTHUJqBjggTQMAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRoVvJMa5i0-hq4TfPoCUKLrvXMTg%26sig%3DAOD64_2bR_5SmGJCaWruuj3pUfMdipuoog%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-DgTsdfE4F_E7s-0UVymzzgh43c5kaQ8cMRaXg6FAC7ghqJttYSUgCPbMnwL-foxHxP-tjHJApP715SPzmohs9gDbt1iOp1_jlqICXALW-B_bvBxU4JjGPgDEI7jF1axs1vbtlvJXGLpjD3INoaKL1s15pC8w%26cry%3D1%26dbm_d%3DAKAmf-BxWsCfjarA4yvosYIJX_sB5kZvLVaCLRNIGhQ1eNiBhoxiiFf6UJSn1EKOwnJas8HwZUgYBqPEijWFlVKXO5LwSSJVodPn5AcN9YZceUzwk--UDyUj01bVdtBmWn4yh5RuRQfONRI6KYDl4znE2Jh1yQwpu_BXxt_Qsf7z-9A1aAUYv_BGegzpdJ-akPGSpy3WF8zSeCH36KP9tLb-OHugPucGtMqcrQq_GUVUawGtPfgY8zKoxNw3EEECgRBGDxfsoi6uGntnNZ7LPoalbuiNfExAaJmWgBSwMbdXyoKXkeodh3-IzgX4o4wTxyfPcbnmR_FBrVFFKKAJLNScC-h6ofM6uFMDamvzLT7eL86_t1RCyYmGz6bKgd3hcyV8KQwcxPoGl1pNC1wGVjwvo0_Bh94dmjg4YyiPeIvrWofF8n9hgJXxuX0RLoNo-6zQEM54vToi%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=9536248076431&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b3fadf544ede2f4ed18b0a67e17c4e221c28134e89efd22386da9b7c6ecb86b4

Request headers

Host: hal900024.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=0549ed6c0a447f72
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/

Response headers

Date: Sun, 03 Oct 2021 02:05:16 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Sun, 03 Oct 2021 03:05:16 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1537
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame C806 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 808022cbc34938c4209bc0bd01a959a222e2fc4b54dc045352ba09be36c80184

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK 728x90_OMAC_2016_Launch%20(4).jpg
cdn.contentspread.net/24i/advertiser/32995/creativesup/ Frame B5BE 44 KB
44 KB 63ms
17ms Image
image/jpeg 88.99.70.21
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/advertiser/32995/creativesup/728x90_OMAC_2016_Launch%20(4).jpg
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=46866900014082500710612011736009&a=6fbf389e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.70.21 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.21.70.99.88.clients.your-server.de
Software: nginx /
Resource Hash: e8ec2a4d84f51a4860526181c3822b954b3a134dc14446ba753b37708470171d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:17 GMT
Last-Modified: Mon, 20 Jun 2016 09:28:47 GMT
Server: nginx
ETag: "5767b74f-af88"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 44936

GET
H/1.1 200
OK viewability Show response
hal90009.redintelligence.net/ Frame B5BE 0
150 B 35ms
12ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/viewability?s=46866900014082500710612011736009&a=de3d34b2&vb=m
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=46866900014082500710612011736009&a=6fbf389e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/request_content.php?s=46866900014082500710612011736009&a=6fbf389e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:17 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame B5BE 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame F260 60 KB
24 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 03 Oct 2021 02:05:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Oct 2021 02:05:17 GMT

GET
H2 200 script.js Show response
s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/js/ Frame F260 2 KB
815 B 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/js/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54980d0ce1ab462210a69cea7a8f61f66d7baf954c2fba0dc4030a6b6e7cb36f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 11:55:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50993
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 733
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 15:27:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Oct 2021 11:55:24 GMT

GET
H/1.1 200
OK stat Show response
stat.meetrics.net/ Frame 801E 82 B
351 B 47ms
11ms Script
application/javascript 136.243.36.130
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.meetrics.net/stat
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.36.130 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h399.meetrics.de
Software: nginx /
Resource Hash: 79b208a19742aa53a96b0902c3b88c3434687c4b2453842d82a50c7b4080417e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:17 GMT
Cache-Control: private, no-cache, must-revalidate
Last-Modified: Sun, 03 Oct 2021 02:05:01 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H/1.1 200
OK gettag Show response
s79.research.de.com/bb-mxad/ Frame 801E 0
208 B 47ms
11ms Script
application/octet-stream 178.63.89.72
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.research.de.com/bb-mxad/gettag
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 178.63.89.72 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h570.meetrics.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:17 GMT
Cache-control: private,must-revalidate
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/octet-stream

GET
H/1.1 200
OK submit
b98.s79.research.de.com/bb-mx/ Frame 801E 43 B
291 B 48ms
14ms Image
image/gif 136.243.16.24
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b98.s79.research.de.com/bb-mx/submit?/0NO8BhAAA/whFtBo0F0wFz6BvvAihF5yA0jEkyBhhF05AkwB5hE4hEk3B11AhiF53A2mE1mE4kEuzEhmFlmFyhFtlFunEvvFnsFlzF5uFkpFjhF0pFvuFujEvtFvzEhmFlmFyhFtlFvxAtwAtzA4vAo0FtsFvjEvuF0hFpuFlyFuoE0tFsBF1pyFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0vB+k2FoywAyxAtwA5tAy3AtwA46A13AtyAywA0zA0tAyuAxyAyuA4tAz0Ax3A3lE5zAKp6Fsp3Fx2AzzAyyA23Ax1A52A2BEjwtFuvFulFnqnFluFtVETsBluFL2wFBLl1FC/2xF3CylFx1FlzF0mF1sFszFjyFllFugBm1FssFzjFylFluFluFhiFslFkgBluFnpFulFfjFoyFvtFlfF5wAg3EpuFkvF3fF3lFirFp0Fz0FvyFhnFlpFumFvgB3pFukFv3Ff3FliFrpF0jFhuFjlFshFupFthF0pFvuFmyFhtFlgB3pFukFv3Ff3FliFrpF0yFlxF1lFz0FhuFptFh0FpvFumFyhFtlFgjEzzFf3FliFrpF0gBjwF1fF0gAyhFtfF4gAthF4fFluFnpFulFf5BwBELlnFB/k0FrBxgAwqFpkF9yAywA0zA0mAhkFj9B53A14Az2A2mAjwFpkF9yA22Aw4AwxAxmAzpF0lF91A51Ay3Az5AmwEshFjlF9zAx1Ax1AzzA12AmjEpkF9xA14AzzAw4A20AmzEp6Fl9B3yA44E5wAmjEi9B3xA22Az1AwyAyBEUkzFpBFAAAAAAYLaBaBAPAAAAAAAAAOAAAAGBAAAAAYLaBaBABPWAAAAAAAABqU2AZIAAFAx8Ez8ExBEGAyyAy1Aw2ArEiuAPAAAFAAqU2TEiuASksFwEbAAAAAAAAAAAAEAAAqU2AAAAAAAIAy2A2wA4wAxxAJAzxA1xA1zAz1A2BEHA15A1yA3zA5BEGA3yA44E5wAJAx1A4zAzwA42A0BEHA53A14Az2A2BEdAAAAAAYLAaBAFAAAEiuAAAaBo0F0wFz6BvvAzwBuyAtkFuuBulF0vB53A14Az2A2vAx2AzyA31A20A25Ax1A2vA1tAJXFFtBChF5vFurBtMElhFklFyiFvhFykFt3Ay4A45BwtAChF5vFuvBpuFklF4uBo0FtsFCATCFAAAAAAAAAAAAAAGAJGFSBFNFFQtjFOUa1VA
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.16.24 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h330.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:17 GMT
Server: nginx
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Sun, 03 Oct 2021 02:05:16 GMT

GET
H/1.1 200
OK data
b98.s79.research.de.com/ Frame 801E 43 B
308 B 46ms
11ms Image
image/gif 136.243.16.24
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b98.s79.research.de.com/data?/0NO8CiAAAl2yFuvFfhFwpFLktFDTkzFARksFAQtjFHcVNSA
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.16.24 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h330.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:17 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Sun, 03-Oct-21 02:05:16 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 9B3F 6 KB
762 B 19ms
18ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,regular

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728553930114966770/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

cf624cca88c1828e4dc1a61151d2ce6e826191ba2223f4cf4cdacc1d8a52981b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 03 Oct 2021 02:05:17 GMT
server: ESF
date: Sun, 03 Oct 2021 02:05:17 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Sun, 03 Oct 2021 02:05:17 GMT

GET
H2 200 DcmEnabler_01_244.js Show response
s0.2mdn.net/879366/ Frame 9B3F 28 KB
10 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/12728553930114966770/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5cda1be06cbf31fbdc5afc91a547b3ff68a4ed02bf4fc98e02625875fa7848de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/12728553930114966770/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 10:24:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 56465
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10271
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Oct 2021 10:24:12 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.2/ Frame ACA9 89 KB
32 KB 53ms
14ms Script
text/javascript 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js

Requested by

Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=38331900017250100710612011736008&a=1460fcb6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d16d07a0353405fcec95f7efc50a2621bc7425f9a5e8895078396fb0dc460c4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 08:04:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64873
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32245
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="hosted-libraries-pushers"
expires: Sun, 02 Oct 2022 08:04:04 GMT

GET
H/1.1 200
OK 728x90_OMAC_2016_Launch%20(4).jpg
cdn.contentspread.net/24i/advertiser/32995/creativesup/ Frame ACA9 44 KB
44 KB 55ms
17ms Image
image/jpeg 88.99.70.21
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/advertiser/32995/creativesup/728x90_OMAC_2016_Launch%20(4).jpg
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=38331900017250100710612011736008&a=1460fcb6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.70.21 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.21.70.99.88.clients.your-server.de
Software: nginx /
Resource Hash: e8ec2a4d84f51a4860526181c3822b954b3a134dc14446ba753b37708470171d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:17 GMT
Last-Modified: Mon, 20 Jun 2016 09:28:47 GMT
Server: nginx
ETag: "5767b74f-af88"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 44936

GET
H/1.1 200
OK 160x600-MSSTORE-Office2016-Launch%20(2)%20(1).jpg
cdn.contentspread.net/24i/advertiser/32995/creativesup/ Frame 55CC 47 KB
47 KB 57ms
16ms Image
image/jpeg 88.99.70.21
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.contentspread.net/24i/advertiser/32995/creativesup/160x600-MSSTORE-Office2016-Launch%20(2)%20(1).jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=36111600011303800710618011736024&a=3bfbadd0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.70.21 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.21.70.99.88.clients.your-server.de
Software: nginx /
Resource Hash: a6d1867d43b9fbb0217e51b5dc3ddd0a4292f937bfa66696f3eba26d1e64d0f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:17 GMT
Last-Modified: Mon, 20 Jun 2016 09:24:22 GMT
Server: nginx
ETag: "5767b646-ba9e"
Content-Type: image/jpeg
Connection: close
Accept-Ranges: bytes
Content-Length: 47774

GET
H/1.1 200
OK viewability Show response
hal900024.redintelligence.net/ Frame 55CC 0
150 B 39ms
15ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/viewability?s=36111600011303800710618011736024&a=c0a8bb90&vb=m
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=36111600011303800710618011736024&a=3bfbadd0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/request_content.php?s=36111600011303800710618011736024&a=3bfbadd0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:17 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 55CC 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK data
b98.s79.research.de.com/ Frame 801E 43 B
308 B 11ms
11ms Image
image/gif 136.243.16.24
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b98.s79.research.de.com/data?/0NO8DvEAA0rvFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0BFLruFBLkqFFlqwFyyAw0Az0AL2vFBlqwFyyAw0Az0ALkmFBTkzFkQ9CAAAAAAAYAAAAdDAQAAAAAAAAAXAAAAdDARksFAQtjFc5DQSA
Requested by: Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.16.24 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h330.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 03 Oct 2021 02:05:17 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Sun, 03-Oct-21 02:05:16 GMT

GET
H2 200 dc_pre=CIP0t9KTrfMCFUaB3godt2EKTg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348
adservice.google.com/ddm/fls/z/ Frame 5773 42 B
107 B 351ms
50ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CIP0t9KTrfMCFUaB3godt2EKTg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIP0t9KTrfMCFUaB3godt2EKTg;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4028568728150.348?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CNm1t9KTrfMCFX7TEQgdFycMoQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105
adservice.google.com/ddm/fls/z/ Frame F759 42 B
107 B 383ms
82ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CNm1t9KTrfMCFX7TEQgdFycMoQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CNm1t9KTrfMCFX7TEQgdFycMoQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2980618559.9912105?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CLT4t9KTrfMCFd134Aodx3ANuQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266
adservice.google.com/ddm/fls/z/ Frame 6CC4 42 B
262 B 346ms
49ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLT4t9KTrfMCFd134Aodx3ANuQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLT4t9KTrfMCFd134Aodx3ANuQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3598860450468.2266?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 03 Oct 2021 02:05:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 801E 0
23 B 20ms
19ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvrRUPOxyXAyNwx40QM1hfRsRYv9Nqrii9F4GWJrI3yjTVhwVn5TxVzIuNqpiwm6TqudAsstxPRpd45eKYrCNnqPh7vbtIU1zXjCAj1nETTYesyhkhF6yqR1vxyCDhwIldATFdTWqA2sox6pHbHfeD5Qs11CV4IQJKY-s47PZqWDlFgLkPN3QhI8sSzI5gS9HtrnTLhbk0FWaNbosWY7ZRp1bZ18XttSjDYSZEHUWURu-qncRnaLoDxSumj4i9vLk_XjWE0vjiltgJXslxpAXAqFyk5a-MFLpzZJL8IO-XOl4xRkRDOgEhnRE_PDBoGF2O42R45ph-YH7BgHdH0tS-p23kcgcWh1z2wCCTsnI6fRKt4pe0v4U0ETT7-AOgewZT8jvLOXOH8nHOv2j55lHry8hIUwqq3uorVqJhR3KloHYiQmQfjefr1oKUrvr-kb3IiP1WgY_iGwqjflsKceMmCtYJBg2s2T223U9RfR20rlbqkJdnNG39nihlCB2Fi9ir3-u78i5QBsuzcHKvunIaMdcmKvGzh8PpTlLv6LzcwlRFMhGZmsuI7gp5t_kkx92xN0I6ATKkrjpuJti0GY4Ii4zRlWvn1zpXiyZ0Z_texHNJFxUbVx1JuRHpSrejyJyEgtqiJDruRxOJPOze-_1TDOFNHBYyc_-7kqkS6-qtFCXhntIgvRaiHYGBhCfxQz7_hPYq8CsRoBvGIQKsmWo-uytNsGaLnuSk7vkN36CQLHlgt3W_vIxvKcFKCFBmKcuM3x0q5X8M5Nt-6WMWk9cpBFwD0w_byPIXAAX3tzFqxa91mnMoaApQl0iB2hIR1tklECrlmi-TEDKLgoadJF0dV6gyhXmJpHuTBaGk9An2ODdd0-mnxcYiS7JdEriLpfOpl7sO8WZEOwgvWuj5hHlNkF8cqjLDo_xCJhDe7CGsHK6gS-7BRwtdmbYOMopuxolyEL6LnvIr0gT969BXOfX1YYHcw1TEo8V-LQFny0NU_VZOmDGTz5WBurNDw57ALllxL99hKLP_bP5rNb_DWTVwFWH0b8J5Xfm6zVj8zdVYMPfh0A8RmiKlKNgpIbZ8VwAh9CT60O3fxe80N8RRtzvgK_IEjtHgRUCy3bg5dSS3RFzQhaOsJsDCwC8zG4uHuVkc1fBeP6hXnUDlEFLF_4xVIT0IWUYACKKx8mnbajc0lQXUiMCiV&sai=AMfl-YTcCTVSW9PsFlJtzXB-eE57Rl_RNxjYrYi2IPS3T54xiZGTTRdjs4UupPezmXpf5pJ60J7ciYzsK63SjMZZFC5NB4yxPzHxBQ07f9Chbzg1bzn6TodUZrhifKN648dbWr7GHca3TpXAZyTKNmDIOq5AbkGa8ND6Qjpf-uY&sig=Cg0ArKJSzMihT-nsV_AsEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=982&vt=11&dtpt=778&dett=3&cstd=203&cisv=r20210928.79993&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Sun, 03 Oct 2021 02:05:17 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 txt1@2x.png
s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/img/ Frame F260 2 KB
2 KB 8ms
8ms Image
image/png 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/img/txt1@2x.png

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b02a3233f069f3f0ccfd31f2021073f91e74b438c7b69d201dd5c1719557f321

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 11:54:20 GMT
x-content-type-options: nosniff
age: 51057
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1685
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 15:27:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Oct 2021 11:54:20 GMT

GET
H2 200 logo.svg
s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/img/ Frame F260 2 KB
1 KB 9ms
8ms Image
image/svg+xml 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/img/logo.svg

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e9b62726c16a24a6c96dfdf09813ae3f6d676bec3d70d8665035e138711e4d91

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 11:55:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 50992
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1053
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 15:27:49 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Oct 2021 11:55:25 GMT

GET
H2 200 bg1@2x.jpg
s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/img/ Frame F260 24 KB
24 KB 9ms
9ms Image
image/jpeg 2a00:1450:4001:80f::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/img/bg1@2x.jpg

Requested by

Host: ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com
URL: https://ba924cd2aa49d09a8ad755ab976f5f8d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b2732f593e4de0876048948d71b5c75f140349eaed97c3d2b15a25fa74863058

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1632756469156/5-IWE-Bayon+-Leaderboard-728x90-Bayon/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 11:54:20 GMT
x-content-type-options: nosniff
age: 51057
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24287
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 15:27:49 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 03 Oct 2021 11:54:20 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 9B3F 15 KB
16 KB 9ms
7ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 29 Sep 2021 16:31:45 GMT
x-content-type-options: nosniff
age: 293612
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 29 Sep 2022 16:31:45 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 9B3F 16 KB
16 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,regular

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb46ed079c3dd3c39af5051b4ada48f29f49151dad4fa218117bad2fdb5e616f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 29 Sep 2021 16:31:57 GMT
x-content-type-options: nosniff
age: 293600
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:21 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 29 Sep 2022 16:31:57 GMT

GET
H/1.1 200
OK viewability Show response
hal90008.redintelligence.net/ Frame ACA9 0
150 B 36ms
12ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/viewability?s=38331900017250100710612011736008&a=4028760c&vb=m
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=38331900017250100710612011736008&a=1460fcb6
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/request_content.php?s=38331900017250100710612011736008&a=1460fcb6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 03 Oct 2021 02:05:17 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame ACA9 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/gif

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 59AC 0
23 B 17ms
17ms Ping
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: pastelink.net
URL: https://pastelink.net/3irkl

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS