simcast.com Open in urlscan Pro
45.79.244.12 Public Scan

Software

nginx/1.23.4 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
an-x-request-uuid: 074f9952-020d-4f0e-8b8a-22a6d55c9af5
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK hbjson Show response
grid.bidswitch.net/ 24 B
362 B 64ms
25ms Fetch
application/json 18.198.246.226
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://grid.bidswitch.net/hbjson
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.198.246.226 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-198-246-226.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 54a073fe1eb16fc3e408f3688cfd7119096b14ef4dca03b4e12fe0ab668ec9cb

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: nginx
Content-Type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 49

POST
H2 204 pb Show response
ad.360yield.com/1914/ 0
165 B 142ms
50ms Fetch 34.242.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.360yield.com/1914/pb
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.242.208.83 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-242-208-83.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:46 GMT
access-control-allow-credentials: true
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
547 B 83ms
46ms Fetch
application/json 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=949296
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f7b7e93366257e56f8a04c45453156f24be9eb471ed9f3c906d65a439a43f5c

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pk5WouzFe%2BOb%2FMMpzZLEvgdTcXduLf2mjnbvDELfedIi%2FqtVwb4KfMy%2FG%2FZiD0Mivam2pX7%2BBjd2hDfZJcx6vZehKKxj6Q74Cg9pVPbtRjl8%2FJTsFItp9dbrJIy2rqKzdxpqy7uc"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 8299cddcccce1c09-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 83ms
30ms Preflight
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Tue, 21 Nov 2023 15:00:46 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
166 B 81ms
28ms Fetch 145.40.97.67
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 145.40.97.67 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

x-nbr: 1
date: Tue, 21 Nov 2023 15:00:45 GMT
server: envoy
vary: origin, Accept-Encoding
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 1

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
190 B 94ms
42ms Fetch 2a02:2638:3::7
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=36&wv=8.21.0&cb=81860123533&lsavail=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::7 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=31536000; preload;
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Kestrel
vary: Origin

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
377 B 163ms
103ms Fetch
application/json 184.30.21.51
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-21-51.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Tue, 21 Nov 2023 15:00:46 GMT

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
408 B 97ms
32ms Fetch
application/json 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 Hessen, Germany, ASN16276 (OVH, FR),

Reverse DNS

ip206.ip-51-38-120.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
content-type: application/json
access-control-allow-origin: https://simcast.com
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
cache-control: no-transform, no-cache
access-control-allow-credentials: true
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 2 KB
2 KB 294ms
218ms Fetch
application/json 34.120.63.153
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.63.153 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 153.63.120.34.bc.googleusercontent.com
Software: envoy /
Resource Hash: 628267b563795d36106290ce0b2bf096d08ea89cc998da22fbe27d78453b6c69

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:45 GMT
via: 1.1 google
accept-ch: Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model
server: envoy
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: max-age=0, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 141
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:46 GMT

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 10 KB
1 KB 845ms
648ms Fetch
application/json 2607:4f00:944:0:3eec:efff:fed0:86a2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2607:4f00:944:0:3eec:efff:fed0:86a2 Piscataway, United States, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 51bcb46f4d5df9d45115a2487ad43e7aafec2157c8709be912c84520d5af8310

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Date: Tue, 21 Nov 2023 15:00:46 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
X-Robots-Tag: noindex
Content-Length: 1106

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ 19 B
579 B 31ms
22ms Fetch
application/json 37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

55.133.120.34.bc.googleusercontent.com

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
an-x-request-uuid: 3a79dbc9-6577-4e1a-a2eb-2e962572ba50
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ 0
159 B 85ms
21ms Fetch 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: application/json

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

GET
H2 200 rules-p-WFJsXCa9VD158.js Show response
rules.quantcount.com/ 160 B
642 B 68ms
31ms Script
application/javascript 2600:9000:223c:6e00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-WFJsXCa9VD158.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:6e00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c505f7e821ae7a1c88e6ce02d8e38b57233d9997445ce06b9ce50be989df5d7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:55:14 GMT
via: 1.1 3a3c1dcacd115187f53f40028ae4bd24.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 335
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 160
last-modified: Tue, 11 Apr 2023 19:39:28 GMT
server: AmazonS3
etag: "8451e96214684fb5c6ec4f91dde0548e"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: A2JGqdFDT6iA0HxeMJKvBMM0gQWJrv7O9K9xtLM78JGw13t7G0Ql1g==

GET
H2 200 bundle.js Show response
static.anonymised.io/light/ 113 KB
32 KB 20ms
16ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/loader.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: e7fab71503c32de03617889c058ae8afa7839bb0ab4b8a368ee3b6c1c8396cda

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:51:58 GMT
content-encoding: gzip
age: 528
x-guploader-uploadid: ABPtcPoXjnGCPvW9gBRiBB14BirHrD63-sYDxs7JrnqnQXuwbuoFoOlnpTUNO24gr-fET2DWlJbrABaQqdw1Xr8qzolbXPwpFbzF
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32363
last-modified: Wed, 15 Nov 2023 16:44:28 GMT
server: UploadServer
etag: "8c678f4c317870d9e5ab314463dd6e5b"
vary: Accept-Encoding
x-goog-generation: 1700066668704139
x-goog-hash: crc32c=PXk3KA==, md5=jGePTDF4cNnlqzFEY91uWw==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 32363
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 21 Nov 2023 15:11:58 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 79AF 603 B
245 B 185ms
183ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9565037823771164&output=html&adk=1272721408&adf=3838797007&lmt=1700578846&plat=1%3A16777216%2C2%3A16777216%2C3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ea=0&pra=5&wgl=1&easpi=1&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2~5&aslcwct=150&asacwct=25&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1700578845828&bpp=3&bdt=1022&idt=376&shv=r20231109&mjsv=m202311130101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5988435948309&frm=20&pv=2&ga_vid=1645018742.1700578846&ga_sid=1700578846&ga_hid=902822427&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079629%2C44809316%2C31078297%2C31079654%2C44806140%2C44807763%2C44808148%2C44808285%2C44809054&oid=2&pvsid=2571529057896910&tmod=1036072201&uas=0&nvt=1&fsapi=1&ref=http%3A%2F%2Fsupport.foxwebapps.com%2F&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=404

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311130101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-9565037823771164&plah=simcast.com&bust=31079654

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: Tue, 21 Nov 2023 15:00:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 63ms
63ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&cls=gdpr-block&ign=false&pw=1600&ph=1200&x=0&y=1060.8

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 63ms
63ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&cls=menutop%20clearfix&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 identity Show response
api.rlcdn.com/api/ 44 B
356 B 79ms
20ms XHR
text/plain 34.120.133.55
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://api.rlcdn.com/api/identity?pid=2&rt=envelope

Requested by

Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/187621-164323601241456.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.120.133.55 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

da45962a1fb4a049c9367ebe9b1b628f071d7a4c9997ee807c01d23f4866e19c

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
via: 1.1 google
x-content-type-options: nosniff
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
access-control-allow-headers: Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length: 44
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 rid Show response
match.adsrvr.org/track/ 63 B
418 B 111ms
35ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=187621
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/187621-164323601241456.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 70240041ce932d0f804b6c864c5beefe1eb3b5cd1fa629a5fadcb202a6e7e440

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
server: Kestrel
vary: Origin, Accept-Encoding
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
expires: Thu, 21 Dec 2023 15:00:46 GMT

GET
H2 403 / Show response
id.sv.rkdms.com/identity/ 72 B
227 B 341ms
119ms XHR
application/json 34.202.199.100
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://id.sv.rkdms.com/identity/?vendor=idsv2&sv_cid=5274_04512&sv_pubid=SENDTONEWS&sv_domain=simcast.com
Requested by: Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/187621-164323601241456.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.202.199.100 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-202-199-100.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 6851edc0fca6eb99fa5fa083c37055fb96b62567bcd4730305e755e4cc0ab82a

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:46 GMT
access-control-allow-credentials: true
server: awselb/2.0
content-length: 72
vary: Accept-Encoding
content-type: application/json

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame E467 6 KB
3 KB 25ms
8ms XHR
application/javascript 13.32.22.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.22.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-22-213.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: 9yABOonr2HqHtwbarUcdbIqN0f4A8Qog
content-encoding: gzip
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
date: Tue, 21 Nov 2023 07:58:10 GMT
x-amz-cf-pop: FRA56-C2
age: 25357
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 29 Aug 2023 08:30:37 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: seTduxinexLXOlnAv6-Z70kx6m56h8bxk8xfzaIKpDU-fIh1f8LjHg==

GET
H2 200 sync Show response
p2.gcprivacy.com/v2/ 451 B
815 B 114ms
114ms XHR
application/json 44.213.251.62
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p2.gcprivacy.com/v2/sync?pid=Q6CV1VBC&uid=92fec20c-b273-4c42-b174-9544015b09d5&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&h=simcast.com&ref=http%3A%2F%2Fsupport.foxwebapps.com%2F&ids=sharedid%2C92fec20c-b273-4c42-b174-9544015b09d5%7C&v=3
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 44.213.251.62 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-213-251-62.compute-1.amazonaws.com
Software: /
Resource Hash: 451dea8ff529fe31a5021d96464b1d8f6ae4da559e948f12748e6f093666ff5c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
access-control-max-age: 86400
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, X-Max
content-length: 451

OPTIONS
H2 204 health
aegis.anonymised.io/ Frame 0
0 70ms
33ms Preflight
text/html 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://aegis.anonymised.io/health
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: OPTIONS, GET
access-control-allow-origin: https://simcast.com
allow: OPTIONS, GET
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 21 Nov 2023 15:00:46 GMT
server: Google Frontend
vary: Origin,Access-Control-Request-Method,Access-Control-Request-Headers
via: 1.1 google
x-cloud-trace-context: f24cab6718388a4454e3b89f5771da6c
x-request-id: jlwzHkoszeJRslPKttlbomxwLwhBIwtb

GET
H2 200 health Show response
aegis.anonymised.io/ 2 B
145 B 28ms
26ms Fetch
text/plain 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://aegis.anonymised.io/health
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
via: 1.1 google
server: Google Frontend
vary: Origin
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
x-cloud-trace-context: ed949b9da10eeef37cd3256826c84252
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
x-request-id: slJmiAvmVMQxyyQPbdeoIURgITpUnvXH

GET
H2 200 css2
fonts.googleapis.com/ 6 KB
789 B 23ms
23ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@500;600&display=swap

Requested by

Host: client
URL: about:client

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

adb5521f6daa28bf7a2f73decfaa78d1bd4efc45ab6e17eca144c3fcc4ccadba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:45:20 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H2 200 bridge3.605.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 1022 752 KB
241 KB 17ms
14ms Document
text/html 2a00:1450:4001:803::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a2eacbd0a55e794d92e79a03b68c07f613a0ab710ffaffe5f1d12d67aac843a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 265170
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 246766
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Sat, 18 Nov 2023 13:21:16 GMT
expires: Sun, 17 Nov 2024 13:21:16 GMT
last-modified: Wed, 15 Nov 2023 19:11:18 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ 44 KB
17 KB 62ms
25ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Nov 2023 15:00:46 GMT

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame 7825 40 KB
14 KB 17ms
15ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6300f448d738e70ac11f0140df0b3ce91a2de9e0da7fdf09d32d28031600ba51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 112
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13893
x-xss-protection: 0
last-modified: Wed, 09 Aug 2023 15:57:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 21 Nov 2023 15:58:54 GMT

GET
H2 200 6c3f03cd-6fa8-4477-ac05-2c0f4f8da092 Show response
config.aps.amazon-adsystem.com/configs/ Frame E467 537 B
813 B 39ms
12ms Script
application/javascript 108.157.4.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.aps.amazon-adsystem.com/configs/6c3f03cd-6fa8-4477-ac05-2c0f4f8da092
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: 1856d9b5b6bab37b309b28fe14f3de828d2997daa7e80b31da276ff234c3a8f6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:31:55 GMT
via: 1.1 6eb77e673c2aa566dbadbc817458b976.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-P2
age: 1731
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=3600
content-length: 537
x-amz-cf-id: s6OjrDG6gvrAUVo2YYiTEOLUUHake0TTw5LWxNQA2igqYiW17zht-Q==

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ Frame E467 1006 B
1 KB 12ms
11ms XHR
application/json 13.32.22.213
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fsimcast.com&pubid=6c3f03cd-6fa8-4477-ac05-2c0f4f8da092
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.22.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-22-213.fra56.r.cloudfront.net
Software: Server /
Resource Hash: fd8e6d26ae464a400f3c77955c4d426cec2d159f514c30ff72f9155f6e606a15

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 09:44:03 GMT
via: 1.1 307a3e1075dd3d0976c64513a6ec3d74.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C2
age: 19002
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1006
x-amz-cf-id: fUcDdhWqx20HrQ-Q4d0lNodhq1MXY5CAVNa_NWqvQgb7phirsaciVA==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 233ms
101ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=mofQyeq02i_XabL-&instance=214426226&version=7.26.0&age=231121&cmd=GET&key=jmgEr5Ik&c_id=12018&seq=1&order=2&vIndex=0&absoluteTime=2455.4&relativeTime=411.5&canonical=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&EXTREF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT&serverHost=embed.sendtonews.com
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 0.js Show response
player.sendtonews.com/bidderFiles/ 5 KB
2 KB 43ms
12ms Script
application/javascript 18.66.248.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://player.sendtonews.com/bidderFiles/0.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-15.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ba005884302c65983e86c49afd2e6bf0d3ca60166c861ee2888d716ceed13e02

Request headers

Referer: https://embed.sendtonews.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: UQ7kWi2taw0bordMiyKDP_I_ByXqD8Mm
content-encoding: gzip
via: 1.1 7251dede1ac94066b27bcd33919b30c6.cloudfront.net (CloudFront), 1.1 bf943aab70e585412f7a215fb0a10790.cloudfront.net (CloudFront)
date: Tue, 21 Nov 2023 11:25:54 GMT
x-amz-cf-pop: FRA60-P3, DUS51-P1
age: 12893
x-cache: Hit from cloudfront
last-modified: Thu, 07 Sep 2023 23:03:22 GMT
server: AmazonS3
etag: W/"25b745fa0d93d47bf009a28d8bcdf8d6"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, POST
content-type: application/javascript
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-id: LlXtj_-XTZMiu4K4W14aIEqwTcbDuCC3pL9GHKZ5GH0auveR9FAz1Q==

GET
H2 200 bootstrapper Show response
tags.qortex.ai/ Frame E467 24 KB
5 KB 41ms
16ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/bootstrapper
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: eaa1fe6daa6d6efa271e07a942dd6cd521cf367b0f2a1470512f43dc315ad50c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 161
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9e5dbfc7TCFTdgJndJU3gi0VKn7QURo%2Be2m6fIobS9jAS3oDStkZI%2BPjOuedBf%2Bbg2o%2BrdS%2BsjJqTeLCiuwck7glVNcDlPbg6w4u%2BjK26T%2Fk1p9UHNA6MsUAUpSVj%2FL0GHdZuuzz4hAkA12Q"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdde5dcd9170-FRA

GET
H2 200 b8m4g88u997vbosa7y0ls62aao2a097j.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 45 KB
46 KB 25ms
9ms Image
image/jpeg 18.66.97.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/b8m4g88u997vbosa7y0ls62aao2a097j.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 728b6eb8db6cfb31e11e1d7db8aa70367ab3457252816fac5fab2fb8dbd0622c

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:57:10 GMT
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 217
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 46116
last-modified: Tue, 21 Nov 2023 14:40:09 GMT
server: AmazonS3
etag: "13ab4853c43c6d68b9bb1f96fe2c5e79"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: y7Pd5TOjPUCcKQHwPR4z_ntEWc8QLSzhQWFsU02MqWuHKWmtUjhzfA==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 228ms
101ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=mofQyeq02i_XabL-&instance=214426226&version=7.26.0&age=231121&cmd=RTP&key=jmgEr5Ik&c_id=12018&seq=1&order=3&vIndex=0&absoluteTime=2459.7&relativeTime=415.8&sC_ID=8783&sm_id=3188399&load=1&status=LVFNSNIY&ac_id=2008&EXTREF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT&DS=found
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI.woff2
fonts.gstatic.com/s/opensans/v36/ 18 KB
19 KB 57ms
18ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

752ac7b6a1d83373e07af1ee17b3a0e4a304e9b9304b55e49d93c7ab6a1c394e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 18 Nov 2023 11:28:29 GMT
x-content-type-options: nosniff
age: 271937
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18628
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 01:36:20 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 17 Nov 2024 11:28:29 GMT

GET
H2 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v140/ 125 KB
126 KB 69ms
31ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v140/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/icon?family=Material+Icons

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8265f64786397d6b832d1ca0aafdf149ad84e72759fffa9f7272e91a0fb015d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 03:53:37 GMT
x-content-type-options: nosniff
age: 385629
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 128352
x-xss-protection: 0
last-modified: Tue, 07 Mar 2023 19:51:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 03:53:37 GMT

GET
H2 200 7469n33r91q891q208nnrn900s70ro36playlist.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/ 291 B
867 B 9ms
8ms XHR
application/x-mpegurl 18.66.97.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/7469n33r91q891q208nnrn900s70ro36playlist.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2a93e4e263df484a3aba58fb9598fe1bb1d7c53c774041d386ad86e981c88ea4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:44 GMT
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 122
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 291
last-modified: Tue, 21 Nov 2023 14:41:43 GMT
server: AmazonS3
etag: "1eb072d951e7c030c02558000f035594"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: 2TPbkI3UbBMV1KXW7ix0NJ5OqHsV58KGhAFrvojqb_0bjzcj4tjyUg==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 203ms
102ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=mofQyeq02i_XabL-&instance=214426226&version=7.26.0&age=231121&cmd=IMA&key=jmgEr5Ik&c_id=12018&seq=1&order=4&vIndex=0&absoluteTime=2485.2&relativeTime=441.3&EXTREF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&playerCfg=FL&recoveryMethod=NONE&imaVersion=3.605.0&blocked=false&recovered=false&hasAdParams=true
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ 6 KB
2 KB 102ms
57ms Fetch
text/xml 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F92056281%2C22632072816%2Fsimcast.com-premium&env=vp&gdfp_req=1&unviewed_position_start=1&ad_rule=1&output=xml_vmap1&sz=480x270&ciu_szs=300x60&description_url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&hl=en&vpa=auto&vpmute=1&vconp=2&cmsid=2631244&plcmt=2&vid=3188399&us_privacy=false&cust_params=sessionKey%3D214426226-mofQyeq02i_XabL-%26schain%3Dstnvideo.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D8783%26placementType%3DPremium%26embed%3DjmgEr5Ik%26domain%3Dsimcast.com%26player_size%3Dsmall%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26version%3D7.26.0%26player_status%3DLVFNSNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00157%26rand%3D8%26uhr%3D16%26us_privacy%3Dfalse%26keywchk%3Dok

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

caa11420cc65f8537b92b87720ff951bb288474d6de67a36cebb8a80f223771a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1009
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lmy919jr855zdpxzf3z872smbaeizcv9.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 41 KB
41 KB 11ms
10ms Image
image/jpeg 18.66.97.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/lmy919jr855zdpxzf3z872smbaeizcv9.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 825131a3888ff43b47077be50bc19618c962cf2672cb4c612566e8b18a86778e

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 21:55:00 GMT
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 61547
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 41536
last-modified: Mon, 20 Nov 2023 21:40:17 GMT
server: AmazonS3
etag: "f445713eea21c8116f85034bd4bfcaba"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: aeIVgMzUjVPtPy7VKdXD9rAR6sJFaomBpdl6RByT22SdYolAoOvWFg==

GET
H2 200 loik4hyqgl9hmwhdrxbez2417zq40i89.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 25 KB
26 KB 11ms
10ms Image
image/jpeg 18.66.97.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/loik4hyqgl9hmwhdrxbez2417zq40i89.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fc6dd7e343eb47b13427254aa45541ef6edca9fbaa6b2d507b1a8ac7889a8404

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 20 Nov 2023 21:55:00 GMT
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 61547
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 26072
last-modified: Mon, 20 Nov 2023 21:40:15 GMT
server: AmazonS3
etag: "32971d43cf0176ed1d61375807854db8"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: j2stn6b8j-htbh_RCLA49rJjRRJxcoeuUKiwhpIEz9S0w00_XS8FHA==

GET
H2 200 pixel;r=233773570;source=gtm;rf=0;a=p-WFJsXCa9VD158;url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0;ref=http%3A%2F%2Fsupport.foxwebapps.com%2F;uht=2;fpan=1;fpa...
pixel.quantserve.com/ 35 B
371 B 21ms
21ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=233773570;source=gtm;rf=0;a=p-WFJsXCa9VD158;url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0;ref=http%3A%2F%2Fsupport.foxwebapps.com%2F;uht=2;fpan=1;fpa=P0-1323837018-1700578846194;pbc=;ns=0;ce=1;qjs=1;qv=6076e8c2-20231114150359;cm=;gdpr=0;d=simcast.com;dst=1;et=1700578846464;tzo=-60;ogl=;ses=12f9c4c5-a827-495e-aa24-d8dc1917f97b;mdl=

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
202 B 31ms
31ms XHR
text/plain 2a00:1450:4001:827::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=902822427&t=pageview&_s=1&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&dr=http%3A%2F%2Fsupport.foxwebapps.com%2F&ul=en-us&de=UTF-8&dt=Simcast%20News%20portal.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAACAAI~&jid=816352369&gjid=1461413828&cid=1645018742.1700578846&tid=UA-205158314-1&_gid=98274753.1700578846&_r=1&gtm=457e3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=339183352

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
241 B 58ms
21ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-RFSL1NPH34&gtm=45je3b81v9124667839&_p=1700578845623&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=1645018742.1700578846&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1700578846&sct=1&seg=0&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&dr=http%3A%2F%2Fsupport.foxwebapps.com%2F&dt=Simcast%20News%20portal.&en=page_view&_fv=1&_ss=1&tfd=2545
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-RFSL1NPH34&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 anonymized_small_black.png
storage.googleapis.com/idw_static_assets/ 2 KB
2 KB 54ms
13ms Image
image/png 2a00:1450:4001:808::201b
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://storage.googleapis.com/idw_static_assets/anonymized_small_black.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:808::201b Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: UploadServer /
Resource Hash: 05adb1a8ab31ced159adf8401bc91d0c28dc75777423ea84358b9565147b5925

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:31 GMT
age: 135
x-guploader-uploadid: ABPtcPqWiDRRp2dRrM8ph31rzB1b8guPJy8BIHrhaFJ_VbeVkpXtvoUS-AZpXI958yXeiHArdf9zjUKfYA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1661
last-modified: Thu, 02 Feb 2023 09:54:23 GMT
server: UploadServer
etag: "d0042077edcb1feff233a5a0e095b327"
x-goog-generation: 1675331663329867
x-goog-hash: crc32c=A2Z1Vg==, md5=0AQgd+3LH+/yM6Wg4JWzJw==
content-type: image/png
cache-control: public,max-age=7890000,no-transform
x-goog-stored-content-length: 1661
accept-ranges: bytes
expires: Tue, 20 Feb 2024 22:38:31 GMT

GET
H3 200 bidderchecker.js Show response
static.anonymised.io/light/ 961 B
418 B 18ms
17ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/bidderchecker.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 722a4121ccf998eefa71a33203ddd5e99a0ba3243c0549cdf7302268fe0ba979

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:53:30 GMT
content-encoding: gzip
age: 436
x-guploader-uploadid: ABPtcPqDxvn9_slcTxFYICbAbCQBVbbSqLgnzEv0OBeWa0GIV1IGY-mBpn2MZT_oDEbGhgdJLOfDbGdnovOkdaWKVomcQA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 387
last-modified: Wed, 15 Nov 2023 16:44:28 GMT
server: UploadServer
etag: "2b75ac851c96912eb29abd4d1a361694"
vary: Accept-Encoding
x-goog-generation: 1700066667964158
x-goog-hash: crc32c=UACcsw==, md5=K3WshRyWkS6ymr1NGjYWlA==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 387
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 21 Nov 2023 15:13:30 GMT

GET
H3 200 timeme.min.js Show response
cdnjs.cloudflare.com/ajax/libs/TimeMe.js/2.0.0/ 6 KB
2 KB 25ms
24ms Script
application/javascript 2606:4700::6811:180e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/TimeMe.js/2.0.0/timeme.min.js

Requested by

Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5725f04fd1f8882b1d02561933d648bb1a91349b0f33031e78ce0668d3751db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 14961806
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1532
last-modified: Mon, 04 May 2020 16:04:02 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03cf2-163a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AtX9TmOk1kGPh9pcQRa3kxjv78F%2Bq5%2B6snlY830Ey8SRHDr9zv7gnNkIui9Tt5P%2BRfkZEy6B6UzCY2RRt676uTmRGBEYNSE%2FoGtuTDv8qYYpCZWJHvtgRscNtL2wY5Ce1n038FWwy4KbBirh%2ByG%2FSd4G"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8299cddefbc7695e-FRA
expires: Sun, 10 Nov 2024 15:00:46 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v36/ 47 KB
47 KB 18ms
16ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v36/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@500;600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b1b9d7cb74a9923d83f36f0026f421940b861fd6e1a51b8f79af45492ed4ed5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 16 Nov 2023 18:16:19 GMT
x-content-type-options: nosniff
age: 420267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48432
x-xss-protection: 0
last-modified: Thu, 14 Sep 2023 00:40:31 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 15 Nov 2024 18:16:19 GMT

GET
H2 200 js Show response
aggle.net/ 202 B
657 B 450ms
153ms Script
text/html 15.197.179.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aggle.net/js?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Requested by: Host: p.gcprivacy.com
URL: https://p.gcprivacy.com/t/gcid_s.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 15.197.179.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a938864f9581ea3da.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash: 832ecde2a95e0b6b350be4b477050177facd60d8b645a99aef680e64f9132419

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Tue, 21 Nov 2023 15:00:47 GMT
date: Tue, 21 Nov 2023 15:00:46 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: gunicorn
content-length: 202
p3p: CP="NOI OUR BUS UNI COM NAV"

GET
H2

200

xandr
p2.gcprivacy.com/v3/id/
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fp2.gcprivacy.com%2Fv3%2Fid%2Fxandr%3Fid%3D%24UID%26gcid%3D81a701ce-c35d-4eba-90b2-3871367e5153
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fp2.gcprivacy.com%252Fv3%252Fid%252Fxandr%253Fid%253D%2524UID%2526gcid%253D81a701ce-c35d-4eba-90b2-3871367e5153
https://p2.gcprivacy.com/v3/id/xandr?id=5480606245884085419&gcid=81a701ce-c35d-4eba-90b2-3871367e5153

0
37 B

106ms
105ms

Image
text/plain

44.213.251.62
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p2.gcprivacy.com/v3/id/xandr?id=5480606245884085419&gcid=81a701ce-c35d-4eba-90b2-3871367e5153
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Server: 44.213.251.62 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-44-213-251-62.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-length: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
an-x-request-uuid: edf1d5f4-e2f1-4ca7-8a26-bc921da24cf9
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://p2.gcprivacy.com/v3/id/xandr?id=5480606245884085419&gcid=81a701ce-c35d-4eba-90b2-3871367e5153
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 66p353674srn78psn2p22n3843r9q281base.en.vtt
d29xw9s9x32j3w.cloudfront.net/videos/cc_text/ 1 KB
2 KB 10ms
9ms TextTrack
text/vtt 18.66.97.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/cc_text/66p353674srn78psn2p22n3843r9q281base.en.vtt
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a60609d39bf82a995e473336c7e9c619b9266d03e2c0399b1c313da0d9ffd5aa

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:57:12 GMT
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 215
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 1194
last-modified: Tue, 21 Nov 2023 14:42:24 GMT
server: AmazonS3
etag: "398ae1a9f43361a2d96548058394ea76"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: text/vtt
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
accept-ranges: bytes
x-amz-cf-id: tD2f7nfmCcGPXs6XJads8iFwhuS7jCX-EWGIEl0ZA-o56i9fOOO3xA==

GET
H2 200 7469n33r91q891q208nnrn900s70ro36.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/ 431 B
1007 B 13ms
13ms XHR
application/x-mpegurl 18.66.97.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/7469n33r91q891q208nnrn900s70ro36.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3a812fcd0baaeac3d222e50597bd2553ae06e529461e0c051136864f6f8d1dbb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:46 GMT
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 121
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 431
last-modified: Tue, 21 Nov 2023 14:42:08 GMT
server: AmazonS3
etag: "78683a9297cd9d01d0237ea403d0da89"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: llalRYDmOOGnq-wIdg0pDqpjzNna58kUCGrT0l2vCuK_cWz4UcMzow==

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ Frame E467 54 KB
17 KB 38ms
12ms Script
application/javascript 2.23.78.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: support.foxwebapps.com
URL: http://support.foxwebapps.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.23.78.67 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-23-78-67.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Tue, 21 Nov 2023 15:15:46 GMT

GET
H2 200 hadron.js Show response
cdn.hadronid.net/ Frame E467 55 KB
10 KB 49ms
23ms Script
application/javascript 2606:4700:10::6816:34ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Requested by: Host: support.foxwebapps.com
URL: http://support.foxwebapps.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:34ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6ee69abe38a87fd8aa0867401e1e14d2831eab6dfb1bb2d97abf65ac57cb5705

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: gzip
cf-cache-status: HIT
cf-bgj: minify
last-modified: Thu, 07 Sep 2023 17:31:32 GMT
server: cloudflare
x-amz-request-id: 907JHMEEKQ08DSV2
age: 877
etag: W/"8bbf05f440008747d4df642e30fc4ddc"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=3600
cf-ray: 8299cddff96590ec-FRA
x-amz-id-2: oJpPJCbEID7z1zM9kIxlsqSbq8xeH5HC5gS4xpeHur3SW4yHO8BbtAlQwktjkw9El2h2R0B/Pt0=

GET
H2 200 7469n33r91q891q208nnrn900s70ro36-00001.ts Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/ 489 KB
490 KB 9ms
8ms XHR
video/mp2t 18.66.97.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/7469n33r91q891q208nnrn900s70ro36-00001.ts
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 001e1ac59295acf0c8c3deb985c98f7e3ebe022bc019800e9270796bf0c138a4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:47 GMT
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 120
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 501020
last-modified: Tue, 21 Nov 2023 14:42:07 GMT
server: AmazonS3
etag: "d2c612eae36c11100a2850379ee316c4"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: video/mp2t
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: Ocqbq2jL_tcJUcuKyfc9rhAC6C29hLZAjRo6o9A65zyWYThTxgW2kQ==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ Frame E467 23 B
458 B 130ms
103ms XHR
text/javascript 52.222.209.4
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&pr=http%3A%2F%2Fsupport.foxwebapps.com%2F&pid=BnAgxSZVlWUWA&cb=0&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22id%22%3A%22standard%22%2C%22mt%22%3A%22v%22%7D%5D&schain=1.0%2C1!stnvideo.com%2CVRAfdwVZOg7jMyH8bxgoOA%2C1%2C%2C%2C&pubid=6c3f03cd-6fa8-4477-ac05-2c0f4f8da092&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.222.209.4 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-209-4.fra56.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 910a343c3141ba3fe805e18bded62490.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P3
x-amz-rid: ADJSSB17M2KJXQ5VXEQM
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: lRQahLOaIsuo6suyHf_DtBgHFaGIwWtd8R13Rs_qNNn0lAQhu2pd9Q==

OPTIONS
H2 204 unruly_prebid
targeting.unrulymedia.com/ Frame 0
0 17ms
15ms Preflight
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Accept-Encoding,Origin,Accept-Language,X-CSRF-Token,x-unruly-override
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 1728000
content-length: 0
content-type: text/plain charset=UTF-8
date: Tue, 21 Nov 2023 15:00:46 GMT

POST
H/1.1 200
OK auction Show response
prebid-server.rubiconproject.com/openrtb2/ Frame E467 173 B
462 B 37ms
10ms XHR
application/json 69.173.144.137
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-server.rubiconproject.com/openrtb2/auction
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 69.173.144.137 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 30ec897e747b7c570c5d398fee91ed6c73b21a95c9493101fdae9816f1cddb2c

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
content-encoding: gzip
x-prebid: pbs-java/2.3.0
Content-Type: application/json
access-control-allow-origin: https://simcast.com
Cache-Control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 168
Expires: 0

POST
H2 204 unruly_prebid Show response
targeting.unrulymedia.com/ Frame E467 0
158 B 34ms
26ms XHR
text/plain 46.228.174.115
AMOBEE

General

Check archive.org

Show headers Download Go to

Full URL: https://targeting.unrulymedia.com/unruly_prebid
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.228.174.115 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cache-control: private, max-age=0, no-cache, no-store
access-control-allow-credentials: true

POST
H2 204 hb Show response
hb.undertone.com/ Frame E467 0
513 B 125ms
99ms XHR
text/plain 18.66.97.124
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=3590&domain=simcast.com
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.124 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-124.fra56.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
via: 1.1 9015971351bc982a04ee209a022bb1f8.cloudfront.net (CloudFront)
accept-ch: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
x-amz-cf-pop: FRA56-P2
x-cache: Miss from cloudfront
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://simcast.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
x-amz-cf-id: o67oVtyWyAXLs79yB-DgdgDEw9n14gCoTaC5a1P8TDmlEp3F5MrAmg==
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ Frame E467 36 B
315 B 140ms
139ms XHR
application/json 172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=438214
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f29cdfa1a786bfcd67d132647422c539e69d3a48fcc55aeaddaec36f6dac967b

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FAUuWhSSPt82l31c6wWBa1mXVlzogHIZvE%2FjfvCeJv1lZoO8LPN9hYGcta8KBoA3y%2BV%2BYgcDFgjiKWyZiPExmHITjj81zkWsuzknTGi328W%2F%2FniqBEbxwfqEAT8RORt5Pk7erste"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 8299cde048821c09-FRA
alt-svc: h3=":443"; ma=86400
content-length: 36
expires: 0

POST
H2 200 auction Show response
tlx.3lift.com/header/ Frame E467 19 B
539 B 32ms
8ms XHR
application/json 3.122.62.245
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=8.5.0&referrer=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&tmax=3000

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

3.122.62.245 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-122-62-245.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
accept-ch: sec-ch-dpr,user-agent,sec-ch-width,sec-ch-viewport-height,sec-ch-save-data,sec-ch-ect,sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-device-memory,sec-ch-ua-bitness,sec-ch-ua,sec-ch-ua-full-version,sec-ch-ua-arch,sec-ch-rtt,sec-ch-ua-mobile,sec-ch-viewport-width,sec-ch-downlink,sec-ch-ua-full-version-list,sec-ch-prefers-color-scheme,sec-ch-ua-platform
x-auction-status: 16
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ Frame E467 0
109 B 48ms
15ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:46 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 prebid Show response
ib.adnxs.com/ut/v3/ Frame E467 19 B
694 B 11ms
11ms XHR
application/json 37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

nginx/1.23.4 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
an-x-request-uuid: 51860f61-f9f2-4e1e-9b14-641631d019df
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 19
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 player-event
events.qortex.ai/api/v1/ Frame E467 0
0 137ms
104ms Fetch 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dTaX%2FwkO4tSYPqM6Z9%2BVYhGQLqVhmdI5244ckRPngY%2FA%2Fo%2FOR2NNwi95IZcXvioKHkj7%2FWEcytokopycaGlAh38qy%2B97678o9YOZjLClD8g6nLCr1xN3IVtq9QJOMd%2FiDp17u1LRw7HurWcwpcs%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cde0983e2c41-FRA
content-length: 0

GET
H2 200 cx-bootstrapper-init Show response
tags.qortex.ai/cxo/ Frame E467 49 KB
9 KB 22ms
18ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/cx-bootstrapper-init
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: ba7e0e72735ea304bac8a43e87c2da1b7ee2d6705e8548a2fde134beb08d7b48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:56 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 21
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lJLP6s7bTRI%2FV6ueurBxd4ZWS54%2FCxvn8iVM2TczG8bAdphJNVK6DguNpMdm2sUzXZ1JGZUnrMXA1waYE9sBkdD5AqTmuEh%2FmNAkAyV2LHcyHbq2y1MYJCfJVSzf202yhR7U70oPC6rYm%2Fjw"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cde068ab9170-FRA

GET
H2 200 init-3392tkd9ir9ggbv3f0mu.js Show response
api.fouanalytics.com/api/ Frame E467 0
504 B 214ms
181ms Script
text/javascript 2606:4700:e4::ac40:a817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.fouanalytics.com/api/init-3392tkd9ir9ggbv3f0mu.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/bootstrapper
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HwrGDEwP4z3jB%2B8jy1nUb0ihvKJLvwgw%2BQ1Qds9zR57bL5c4Na8b72ApirdmygqP80wD9IVc9D6D%2FDJ3ZeCnyrIzOJ66yzEcs91vQYY6hhKJ99d3XIVbhV7c4pZn9SFm%2B3Jk4mxkG1MNtYdGp9EEGkTapA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
cf-ray: 8299cde099a45c50-FRA
alt-svc: h3=":443"; ma=86400
expires: 0

GET
H2 200 noscript-3392tkd9ir9ggbv3f0mu.gif
api.fouanalytics.com/api/ Frame E467 0
284 B 215ms
182ms Image
image/gif 2606:4700:e4::ac40:a817
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api.fouanalytics.com/api/noscript-3392tkd9ir9ggbv3f0mu.gif
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a817 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QkhzSRRkjb2EOAkImFp0en6BQU7W8RGfXeRZAVBJ2BSWeUZKc3G2FCjkgIeehAdtbMeDesKmGYt2SNOXxl3bqCu3%2FNQr0i4B0h3HssTp4ImUUw5vGAxoxGcwRiUJBIBs5Uc3CmSE5MXFJJuEIfv84qEvVg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: private, no-cache, no-store, must-revalidate, max-age=0
cf-ray: 8299cde099a15c50-FRA
alt-svc: h3=":443"; ma=86400
expires: 0

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ Frame E467 96 B
282 B 111ms
111ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=694&sync=0&domain=simcast.com&url=https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b9d09c8c4015a8913981c3d58725a0513e076b9be5757fba8c0cb4ca0b447366

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 8299cde18f253667-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 134ms
108ms Preflight
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=694&sync=0&domain=simcast.com&url=https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 8299cde0de5d3667-FRA
content-length: 0
content-type: application/json
date: Tue, 21 Nov 2023 15:00:46 GMT
debug: OPTIONS block
expires: Wed, 20 Nov 2024 15:00:46 GMT
server: cloudflare

GET
H2 200 7469n33r91q891q208nnrn900s70ro36.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/ 431 B
1006 B 9ms
8ms XHR
application/x-mpegurl 18.66.97.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/7469n33r91q891q208nnrn900s70ro36.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-97-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4e53cc10c2bf52617941e63de13cb8d45141805428da8a6e1d910c42f09e0f29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:58:49 GMT
via: 1.1 7ed0982309781d390a105a3ead66dbfa.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 118
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 431
last-modified: Tue, 21 Nov 2023 14:41:54 GMT
server: AmazonS3
etag: "d967fb2f0b8e25933b46110c83c2c322"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
accept-ranges: bytes
x-amz-cf-id: lHnKjBphmjCKiwhBS0bcr9pNxb_y-WqfioCLlelQpbS09_xv8OA-AA==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 100ms
99ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=mofQyeq02i_XabL-&instance=214426226&version=7.26.0&age=231121&ldt=BIDS&key=jmgEr5Ik&c_id=12018&seq=1&order=5&vIndex=0&absoluteTime=2948&relativeTime=904.1&sm_id=3188399&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=8783&load=1&status=LVFNLNIY&ac_id=2008&bidIndex=1&prebid.cid=0&prebid.bidders.rubicon.time=62.3&prebid.bidders.unruly.time=62.8&prebid.bidders.undertone.time=129&prebid.bidders.ix.time=156.8&prebid.bidders.triplelift.time=52.9&prebid.bidders.pubmatic.time=62.6&prebid.bidders.appnexus.time=46.9&prebid.start=2782.6&prebid.time=164.2&prebid.timeout=3000&adIndex=-1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:46 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 1022 156 B
145 B 241ms
213ms XHR
text/xml 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?slotname=%2F92056281%2Fsimcast.com-premium&sz=480x270&ciu_szs=300x60&cust_params=sessionKey%3D214426226-mofQyeq02i_XabL-%26schain%3Dstnvideo.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D8783%26placementType%3DPremium%26embed%3DjmgEr5Ik%26domain%3Dsimcast.com%26player_size%3Dlarge%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26version%3D7.26.0%26player_status%3DLVFNLNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00157%26rand%3D20%26uhr%3D16%26us_privacy%3Dfalse%26keywchk%3Dok&url=https%3A%2F%2Fsimcast.com%2F&unviewed_position_start=1&output=xml_vast4&env=vp&gdfp_req=1&ad_rule=0&video_url_to_fetch=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F119.0.6045.159%20Safari%2F537.36%2Cgzip(gfe)&vad_type=linear&vpos=preroll&pod=1&ppos=1&lip=true&min_ad_duration=0&max_ad_duration=250000&vrid=1263268&us_privacy=false&hl=en&cmsid=2631244&plcmt=2&vconp=2&video_doc_id=3188399&vpa=auto&vpmute=1&cnc=22632072816&kfa=0&tfcd=0&sdkv=h.3.605.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&u_so=l&ctv=0&mpt=stnvideo%2Fplayer&sdki=445&ptt=20&adk=2858638697&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.605.0&sid=FD23508F-E67B-438F-9E33-4EF72AA85A7D&nel=0&eid=44750823%2C44770824%2C44772139%2C44777649%2C44781409%2C44802074%2C44802463%2C44804291&ref=http%3A%2F%2Fsupport.foxwebapps.com%2F&top=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&loc=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&dlt=1700578844806&idt=1876&dt=1700578846942&cookie_enabled=1&correlator=767089133450727&scor=3761982533844456&ged=ve4_td2_tt0_pd2_la2000_er0.0.0.0_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8cd629187427fdb93787d7156be7a32c391bb2a8da471bbaa274e806e48b36e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 113
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 jsync Show response
aggle.net/ 325 B
973 B 175ms
175ms Script
text/html 15.197.179.7
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://aggle.net/jsync?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Requested by: Host: aggle.net
URL: https://aggle.net/js?pid=NEQ7KDHP5&domain=simcast.com&pih1=&pih2=&pih3=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 15.197.179.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a938864f9581ea3da.awsglobalaccelerator.com
Software: gunicorn /
Resource Hash: b56f7a03e393303e14b0297bd4cc914ab8c86ee532b6022b74fb08ff3e9e53ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Tue, 21 Nov 2023 15:00:48 GMT
date: Tue, 21 Nov 2023 15:00:47 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: gunicorn
content-length: 325
p3p: CP="NOI OUR BUS UNI COM NAV"

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 49ms
17ms Preflight
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 21 Nov 2023 15:00:46 GMT
expires: 0
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 213320
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
246 B 143ms
102ms Fetch
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&gdpr=0&src=pbjs&ver=8.21.0&coppa=0
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H/1.1 200
OK / Show response
id.a-mx.com/sync/ 66 B
264 B 53ms
13ms Fetch
application/json 131.153.158.209
SECUREDSERVERS-EU

General

Check archive.org

Show headers Download Go to

Full URL: https://id.a-mx.com/sync/?tagId=&ref=http://support.foxwebapps.com/&u=https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0&tl=https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0&nf=0&rt=true&v=8.21.0&av=2.0&vg=aaw&us_privacy=null&am=null&gdpr=0&gdpr_consent=
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 131.153.158.209 Amsterdam, Netherlands, ASN60558 (SECUREDSERVERS-EU, US),
Reverse DNS
Software: /
Resource Hash: cac540e43f2ae5675c0a82f82b1a4da98f18c8b2a09ce51c730900619b3fad4d

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:46 GMT
access-control-allow-credentials: true
content-length: 66
content-type: application/json

GET
H2 200 json Show response
gum.criteo.com/sid/ 2 B
370 B 42ms
15ms Fetch
application/json 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: application/json

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 239860
expires: 0

GET
H2 200 pbhid Show response
id.hadron.ad.gt/api/v1/ 227 B
236 B 22ms
20ms Fetch
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/api/v1/pbhid?partner_id=405&_it=prebid
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd3a4d8bf0c729b06a3dc960854b7cec069097c4447ac6ce4606a1d18d8dd9b9

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: gzip
server: cloudflare
allow: POST, OPTIONS, GET
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cf-ray: 8299cde1ffab3667-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

POST
H2 200 prebid Show response
id5-sync.com/api/config/ 135 B
412 B 56ms
16ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/config/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

480613f771d4b2960ecbcbf9f0a8435d009d8f5fd10ab14bba1b1018762708e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H2 204 any Show response
idx.liadm.com/idex/prebid/ 0
366 B 314ms
103ms Fetch 54.84.191.206
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/prebid/any?resolve=nonId

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.84.191.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-84-191-206.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains
vary: Origin
request-time: 1
access-control-allow-origin: https://simcast.com
cache-control: max-age=3599, private
access-control-allow-credentials: true
trace-id: 12aa380eaf7abfc3
expires: Tue, 21 Nov 2023 16:00:47 GMT

GET
H2 200 id Show response
id.crwdcntrl.net/ 43 B
314 B 99ms
32ms Fetch
application/json 34.250.99.225
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id?c=17228
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.99.225 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-99-225.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: a96e1e97d62ab9747678b947bdf0a0ea5f81790b1e3a1df2d4607a86bf802596

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.13.101
access-control-allow-credentials: true
content-length: 43
expires: 0

GET
H/1.1 200
OK fpc Show response
at.teads.tv/ 0
334 B 62ms
36ms Fetch
text/plain 23.192.153.28
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://at.teads.tv/fpc?analytics_tag_id=PUB_17018&tfpvi=&gdpr_consent=&gdpr_status=22&gdpr_reason=220&ccpa_consent=&sv=prebid-v1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.192.153.28 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-192-153-28.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:47 GMT
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:47 GMT

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 36ms
10ms Script
application/javascript 2600:9000:223c:f800:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223c:f800:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:30:08 GMT
via: 1.1 3a3c1dcacd115187f53f40028ae4bd24.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'
x-amz-cf-pop: FRA56-P2
age: 1840
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8730
x-amz-expiration: expiry-date="Tue, 17 Oct 2028 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
last-modified: Tue, 17 Oct 2023 13:17:45 GMT
server: AmazonS3
etag: "c46e30de24d0f12167e302e9e32ff4a5"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: t-VSwdV8akdjtkbUz-wED8dBHCq8zJSKazNzCeTEq_zv_of2gbQ-Sw==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 37ms
11ms Script
text/javascript 2600:9000:243d:da00:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:243d:da00:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Tue, 21 Nov 2023 10:03:28 GMT
Via: 1.1 d6aad4784aecf0aa7f937dad10d2faea.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: DUS51-P4
Age: 17840
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: HEsUNEj5DNx9k_WisoD4WJbIjOu1AZE3MVeivwoh3fsDJFVkmhRfPA==

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 155 KB
34 KB 48ms
22ms Script
text/javascript 2606:4700:10::6816:3556
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3556 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

902f47bc9eeb026da8cbcef8c7ec51aaa1f73bf7ca587c8694cceb36ff91a92e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 16 Nov 2023 09:30:02 GMT
server: cloudflare
x-amz-request-id: 50AD3MB2RZ3KVN2G
age: 2781
etag: W/"5cdc7028bae687cbffcc9d7982dd9ad5"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 8299cde27fa03837-FRA
x-amz-id-2: FwZa/no8lB8zcgdQW62f0w2J7PIIblXuX9AX0W6QFFlU5YTuezs6/j1GE2QlsXGU2Z1gDKNhl6I=

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 63ms
22ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx
etag: W/"653b5c0e-a9a7"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 22 Nov 2023 15:00:47 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 56ms
15ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 12 Nov 2023 06:38:57 GMT
content-encoding: gzip
age: 807710
x-guploader-uploadid: ABPtcPqNl0_c7mOVHVehFbpvBDCYrlpMq3zlKY0iT8ZNCSTUmKqOFKvvyge5cYXvjpEp3qctN1IhbOKtoVDeGx23F8-Q
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Mon, 11 Nov 2024 06:38:57 GMT

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 68ms
28ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: a1f48c5c49d16231039d676613258f70
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 34ms
9ms Script
text/javascript 65.9.66.122
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-122.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:38:20 GMT
content-encoding: gzip
via: 1.1 afb3db4ac63e94a7684b97827417941c.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 26548
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: Jz8o_vr-Xn1y0NyA4eR5mBeQptz2E1b-5OqdgwZWfoTkOUOo-xQrTQ==

GET
H3 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 39ms
27ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 37961
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230079-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0%2BXfe4hFQJPirOalOw6nCCXrBXZCFRk0ZObTmzNHN01W0LtTxIPcU8Uipceb7u9X2OuTPjf%2BzkduJjq2Hru7BzXIx%2F7ryMucpEY5fRS4xd9fuN3e9O%2FGyEj05XpGE9ZhjGCa5UXEDBF9uiT2glQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 8299cde268112bc2-FRA

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 11 KB
5 KB 40ms
14ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cfe89b284e6a2100a86b8d6b0e52b76b85cc62622a40d63e929f328d883a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:13 GMT
server: cloudflare
age: 564908
etag: W/"65401291-2b7d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 8299cde27d872bdf-FRA
expires: Fri, 24 Nov 2023 15:00:47 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 140 KB
38 KB 674ms
673ms Fetch
text/plain 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2571529057896910&correlator=3520640962818187&eid=31079630%2C31079659%2C31079723%2C31079525&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22181265%3A22632072816%2Csmc_970v_2%2Csmc_300v_4%2Csmc_300v_3%2Csmc_sticky_footer_2%2Csmc_200v_2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F5&prev_iu_szs=970x250%7C970x90%7C728x250%7C728x90%2C336x280%7C320x100%7C300x250%7C300x100%2C336x280%7C320x100%7C300x250%7C300x100%2C728x90%2C970x90%7C728x90&ifi=2&sfv=1-0-40&sc=1&cookie_enabled=1&abxe=1&dt=1700578847074&lmt=1700578847&adxs=315%2C791%2C1230%2C0%2C315&adys=310%2C1172%2C405%2C2240%2C2008&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C1%7C2&ucis=1%7C2%7C3%7C4%7C5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=http%3A%2F%2Fsupport.foxwebapps.com%2F&vis=1&psz=1600x0%7C417x0%7C339x0%7C1600x2170%7C1600x0&msz=1600x0%7C417x0%7C339x0%7C728x0%7C1600x0&fws=0%2C0%2C0%2C128%2C0&ohw=0%2C0%2C0%2C0%2C0&ga_vid=1645018742.1700578846&ga_sid=1700578846&ga_hid=902822427&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRjf0peTvzFIAFICCGQSGAoJeWFob28uY29tGN7Sl5O_MUgAUgIIZBIZCgp1aWRhcGkuY29tGN_Sl5O_MUgAUgIIZBIbCgxpZDUtc3luYy5jb20Y39KXk78xSABSAghkEhwKDWNyd2RjbnRybC5uZXQY39KXk78xSABSAghkEhkKCnB1YmNpZC5vcmcY39KXk78xSABSAghkEh0KDmVzcC5jcml0ZW8uY29tGN7Sl5O_MUgAUgIIZBIXCghydGJob3VzZRje0peTvzFIAFICCGQSFAoFb3BlbngY3tKXk78xSABSAghkEhsKDGxpdmVyYW1wLmNvbRjf0peTvzFIAFICCGQSHQoObGl2ZWludGVudC5jb20Y39KXk78xSABSAghk&dlt=1700578844806&idt=1301&ppid=92fec20cb2734c42b1749544015b09d5&prev_scp=refresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dadhesion%7Crefresh_count%3D0%26hb_bd%3D0%26anh%3Dtrue&cust_params=gcRTDTest%3Dtrue%26pbstck_ab_test%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D10%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D500%26wrap_l%3D1600%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D200%26padpr%3D20%2633acrossId%3Dfalse%26amxId%3Dfalse%26criteo%3Dfalse%26hadronId%3Dfalse%26id5Id%3Dfalse%26identityLink%3Dfalse%26liveIntentId%3Dfalse%26lotamePanoramaId%3Dfalse%26pairId%3Dfalse%26quantcastId%3Dfalse%26sharedId%3Dtrue%26teadsId%3Dfalse%26uid2%3Dfalse%26uids%3Dpubcid%26uids_c%3D1%26waai%3D500%26gc_bucket%3DH%26waae%3D900%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D1s&adks=4147964202%2C477432160%2C2595414818%2C2910413312%2C3159841141&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b44fc68156764855f4da589a4c90e4010e5e1f63c1a1372c7a91b3e61c3cb03d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 38793
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6E55 6 KB
3 KB 123ms
48ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
expires: Wed, 20 Nov 2024 15:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 694 Show response
a.ad.gt/api/v1/u/matches/ Frame E467 12 KB
4 KB 48ms
21ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/694?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&_it=amazon&partner_id=694
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7167039c72b19fc41beb4817dff7e3d419667e40598e843dee9d2f3f284bac2f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 21 Nov 2023 14:57:15 GMT
server: cloudflare
age: 212
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 8299cde29fe9bb95-FRA

GET
H3 200 collect.min.js Show response
static.anonymised.io/light/ 5 KB
2 KB 23ms
22ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/collect.min.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 4421d90bbf983478021bbc14981742e33af47dcfbbbbd2df44b975257fde30cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:51:04 GMT
content-encoding: gzip
age: 583
x-guploader-uploadid: ABPtcPoLRmjRvbXidg4-NLvUzgUCjuafhb0klh6daxm3WkRBLtVrfu0Nzy1QKCmVtwWF1rTlXV8mNvW45Oq98HoCFQM48Q
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1975
last-modified: Wed, 15 Nov 2023 16:44:30 GMT
server: UploadServer
etag: "97360f3ec33fc756a2818c17090aa601"
vary: Accept-Encoding
x-goog-generation: 1700066670155144
x-goog-hash: crc32c=+QDa7Q==, md5=lzYPPsM/x1aigYwXCQqmAQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 1975
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 21 Nov 2023 15:11:04 GMT

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
271 B 53ms
14ms Fetch
application/json 162.19.138.117
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.117 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533568.ip-162-19-138.eu

Software

Resource Hash

838428441c139fbdb2f8976608fb144594cf3393af579f8dfc4a4be1bd7cfe9b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58813/ 2 B
199 B 42ms
16ms XHR
application/json 3.75.62.37
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fsimcast.com%2F

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://simcast.com
content-type: application/json
access-control-allow-credentials: true

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
329 B 107ms
33ms XHR
application/json 52.215.24.0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.24.0 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-24-0.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 365162c62db94820552bb1792dff5e2a6db6832bf415ba1f3ae0d8e9b34d4438

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.15.2
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H3 200 interestscores.js Show response
static.anonymised.io/light/ 3 KB
2 KB 20ms
19ms Script
application/javascript 34.107.217.107
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.anonymised.io/light/interestscores.js?v=0.2.9
Requested by: Host: static.anonymised.io
URL: https://static.anonymised.io/light/bundle.js?v=0.2.9
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.107.217.107 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 107.217.107.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 0409134df4107fe3d86b26248e3e8253287e929e94b690173bbab16e35686cd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:56:59 GMT
content-encoding: gzip
age: 228
x-guploader-uploadid: ABPtcPq_ZWujr37KW11XsRQfqn4DxZGvCh9oVmviPwD2P7nwD4JNaMzI8W7fbLpXNALB0UnqtfT1IAmoI34hXO6KPQrJ-A
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1601
last-modified: Wed, 15 Nov 2023 16:44:31 GMT
server: UploadServer
etag: "c5b77cf922537a364f3dcc1d63109155"
vary: Accept-Encoding
x-goog-generation: 1700066671574570
x-goog-hash: crc32c=W/CKVg==, md5=xbd8+SJTejZPPcwdYxCRVQ==
access-control-allow-origin: *
access-control-expose-headers: Content-Type
cache-control: public,max-age=1200
x-goog-stored-content-length: 1601
accept-ranges: bytes
content-type: application/javascript
expires: Tue, 21 Nov 2023 15:16:59 GMT

GET
H2 200 envelope Show response
lexicon.33across.com/v1/ 49 B
101 B 107ms
106ms XHR
application/json 35.244.193.51
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://lexicon.33across.com/v1/envelope?pid=0010b00002PIxPJAA1&src=esp&ver=1.2.0
Requested by: Host: cdn-ima.33across.com
URL: https://cdn-ima.33across.com/ob.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.193.51 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 51.193.244.35.bc.googleusercontent.com
Software: /
Resource Hash: d0d2e098cd489ef7bc528c86de8ab5c51b5d6cdf9b76a8b08766036992f0d2f4

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google
vary: origin
content-type: application/json
access-control-allow-origin: https://simcast.com
cache-control: private, must-revalidate, max-age=28800
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1

85 B
202 B

115ms
114ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 8396d2e2fd07470d825aa6e13ad56160701f5a1d0176af94c2cc4510e301a7ae

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-qZ5Nea0AnncDtIwjdoJG87a8YdU"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://simcast.com
location: /esp?url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 285 B
559 B 69ms
28ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 365b9ddb2a801422b3c3b8ca6c962ab94b2290238bf0f87e1eef6575d060bfcb

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 google, 1.1 google
server: Google Frontend
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 6b5c34c28cc1d1a4b3827b1c1b157d37
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With
content-length: 285
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 9B3C 15 KB
6 KB 17ms
16ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
server: Kestrel
server-processing-duration-in-ticks: 343173
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

POST
H2 200 579.json Show response
id5-sync.com/g/v2/ 251 B
528 B 48ms
16ms Fetch
application/json 162.19.138.118
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/579.json

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.118 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533569.ip-162-19-138.eu

Software

Resource Hash

cb75486decdcd65b451b3f9dbc33ef63f2fc77c4cc3298b36c7f626ca57440b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
content-type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

POST
H2 204 csi
csi.gstatic.com/ Frame 1022 0
225 B 334ms
107ms Ping
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~lp8gqjz3&c=5988435948309&slotId=2994217974154.5&eee=missing-element&bi=missing-id&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 101ms
101ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=mofQyeq02i_XabL-&instance=214426226&version=7.26.0&age=231121&ldt=NO_IMP&key=jmgEr5Ik&c_id=12018&seq=1&order=6&vIndex=0&absoluteTime=3222.8&relativeTime=1178.9&sm_id=3188399&visiblestatecd=I&soundcd=OFF&alt=0&sC_ID=8783&load=1&status=LVFNLNIY&ac_id=2008&adIndex=-1&DS=found
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H2 200 p
sb.scorecardresearch.com/ Frame E467 43 B
300 B 39ms
9ms Image
image/gif 18.66.112.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1700578846434&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=42375&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.3.4.190424&ns_st_pn=1&ns_st_tp=1&ns_st_ci=3188399&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_ap=0&ns_st_dap=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_st_ldw=0&ns_st_ldo=0&ns_ts=1700578847195&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=760&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=vc12&ns_st_ge=Sports&ns_st_st=SendtoNews&ns_st_ce=0&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Cheddar%20News&c3=sendtonews&c4=Business&c6=*null&c7=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&c8=&c9=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0
Requested by: Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-37.fra56.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
via: 1.1 342054511f9732c450e11bade76323dc.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA56-P5
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: hVu4csINv3mrT7xq8Gm_1vfLHZzz5g9U-LTTaw3JB25cxOLuXV7noQ==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 103ms
98ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=mofQyeq02i_XabL-&instance=214426226&version=7.26.0&age=231121&cmd=INV&key=jmgEr5Ik&c_id=12018&seq=1&order=7&vIndex=0&absoluteTime=3231.6&relativeTime=1187.7&alt=0&sC_ID=8783&sm_id=3188399&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 103ms
99ms Ping
image/gif 3.228.209.251
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=mofQyeq02i_XabL-&instance=214426226&version=7.26.0&age=231121&cmd=PLAY&key=jmgEr5Ik&c_id=12018&seq=1&order=8&vIndex=0&absoluteTime=3232.1&relativeTime=1188.2&alt=0&sC_ID=8783&sm_id=3188399&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&REF=https://simcast.com/?d=foxwebapps.com%26pcid=48%26rid=112%26a=0&playerCfg=FL&playerType=FLOAT&pposition=home
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/easy-stn-player/7.26.0/easy-stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.228.209.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-228-209-251.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET cs
a.usbrowserspeed.com/ 0
0

GET
H2

200

sid Show response
mug.criteo.com/ Frame 9B3C
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=simcast.com&sn=ChromeSyncframe&so=0&topUrl=simcast.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=bIBjPHxCYWJZY2dvZHVJWUQvWlN3WTNGeStXbTR5TTUvZnF3bTdhNTdIUDdUZ0FIZ1RpZWlWT0tLZGdVNU1CcG16QUNibGM1VE5WYmtBTmZiVGUwbE1jdHFPUHRDcEE2T2lzSmFhNU1Tb0EzWTUxWVBPR3pBV2ZjMjZ0Vj...

428 B
654 B

24ms
16ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=bIBjPHxCYWJZY2dvZHVJWUQvWlN3WTNGeStXbTR5TTUvZnF3bTdhNTdIUDdUZ0FIZ1RpZWlWT0tLZGdVNU1CcG16QUNibGM1VE5WYmtBTmZiVGUwbE1jdHFPUHRDcEE2T2lzSmFhNU1Tb0EzWTUxWVBPR3pBV2ZjMjZ0VjUza05oVnF2SEV2TXdhSTN0R0RJQkhaTGpueXhkS0lZcnpGRWkzNHpMUU14M3NIRnFJbDFZY0diNkVad3N2VjkvR0Y4QWxsVFNsTGRYdWdsU1FWTndmSHY1MFp5b0h3aEdBV2VlTC9EZFV5dzRoMXBuWlM0ZXhYczRMR2ZMZFVuZTdtU0MzNW1aTEFoVUJ3bFNxY3NPY2g2WnBCU01XUT09fA&cppv=2

Requested by

Host: simcast.com
URL: https://simcast.com/?d=foxwebapps.com&pcid=48&rid=112&a=0

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

92d177e329311c4a89fc4a08636971cba7e1bc5fa32823b1a7c41852c8ff01c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1342634
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:46 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=bIBjPHxCYWJZY2dvZHVJWUQvWlN3WTNGeStXbTR5TTUvZnF3bTdhNTdIUDdUZ0FIZ1RpZWlWT0tLZGdVNU1CcG16QUNibGM1VE5WYmtBTmZiVGUwbE1jdHFPUHRDcEE2T2lzSmFhNU1Tb0EzWTUxWVBPR3pBV2ZjMjZ0VjUza05oVnF2SEV2TXdhSTN0R0RJQkhaTGpueXhkS0lZcnpGRWkzNHpMUU14M3NIRnFJbDFZY0diNkVad3N2VjkvR0Y4QWxsVFNsTGRYdWdsU1FWTndmSHY1MFp5b0h3aEdBV2VlTC9EZFV5dzRoMXBuWlM0ZXhYczRMR2ZMZFVuZTdtU0MzNW1aTEFoVUJ3bFNxY3NPY2g2WnBCU01XUT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 343552
content-length: 0
expires: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 699B 0
167 B 68ms
23ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Tue, 21 Nov 2023 15:00:47 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H2 200 container.html Show response
622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DCC3 6 KB
3 KB 18ms
16ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
expires: Wed, 20 Nov 2024 15:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5142 6 KB
3 KB 17ms
13ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
expires: Wed, 20 Nov 2024 15:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame EDFF 6 KB
3 KB 18ms
17ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
expires: Wed, 20 Nov 2024 15:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9006 6 KB
3 KB 14ms
14ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
expires: Wed, 20 Nov 2024 15:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 046F 6 KB
3 KB 20ms
19ms Document
text/html 2a00:1450:4001:82b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
expires: Wed, 20 Nov 2024 15:00:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 csi
csi.gstatic.com/ Frame 1022 0
54 B 112ms
107ms Ping
image/gif 2607:f8b0:4006:81e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~lp8gqkev&c=5988435948309&slotId=2994217974154.5&ghmsh_eids=44750823%2C44770824%2C44772139%2C44777649%2C44781409%2C44802074%2C44802463%2C44804291
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.605.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81e::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cx-overlay.js Show response
tags.qortex.ai/cxo/ 127 KB
43 KB 22ms
22ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/cx-overlay.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-bootstrapper-init
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9fba1b0797e04bb4e94dffcf9068f89e75b4fa5569dc9efcb5aa72275435457b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:47 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 76
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BBU8s4pNX5GVzBXOAkDo8Y3hDbdYWUikx%2BGzw5lGwu2I4aIoeJ5WnnOsCsI3ngvk1MwBrhrDDcagBxI11tcQNvohJDihq3bQEuD2weVjF6L0gWg6d52OHeKoh%2BYA67vCBYBfj5lz34ifUXhZ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cde71b279170-FRA

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 63A8 624 B
242 B 56ms
53ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjglrvGATAB&v=APEucNUhzal7Z1vMLmqdYHbvucwKgMBYh7HK6icDGJqGlK6YsmIVD3ZUH8mjaBGk1EbSracZMC4LubzmR-6dtsqcxUyEqX0vaFCiy0JJSqiUtEvF9bvMbfR8frq5ylp-XjYWhhR9Y0TczQ2--ZgXMqaghdgt7qI52QObCTijdPY2UzpUZEazVmdWRhCCzJqzJw_LF1T1cN4-VU6WJf51eJzQPNtJ52s1MQ

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame DCC3 89 KB
31 KB 264ms
264ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf940bd2489897434455528323cf66c4e3aecd5eea963f1d99d96acd452d6dd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31498
x-xss-protection: 0
server: cafe
etag: 4296746511219988724
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DCC3 42 B
63 B 49ms
48ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AY5bKORxLlDTERgmOnNjqI4j0kCPwSMAG5ndfe5IB07lPjclviWbk4zjfK1DBMX0LbkWgICSJE1mQFnVsA33q7OvHpGfamtL1DjLP-xDXXHvakEls

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DCC3 0
20 B 49ms
48ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2944434094795118679&x=1&ct=77

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame DCC3 3 KB
1 KB 79ms
32ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15729
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame DCC3 20 KB
9 KB 61ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame DCC3 0
0 69ms
23ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQgLgnlCzlB9avws42mukYuDmRVDUnhklFLs67dLVIcIIY8xHMogEdMjcBR8x0iXb6dTzrboy-7MYekmL0HFWCBknyzPQ
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame DCC3 202 KB
64 KB 240ms
194ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame F57C 624 B
242 B 59ms
57ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUYJxq78z0gUnorrAXydM1-ZhvIXA-qbQFufH_R6xw7E-zPnnkH7NGjcI_pcIu9TjCjJ1gNB2lUbxM8xg1Qtat6TqhqPWxpBXYPWm2CLGFKDj676-ffAJ4yWCaq0vaNxk4HAMfGsMBZGSVRWfwNi0CYCgPGzJ5YCteQovgg1H72Mq5Z6GNIa8iEVzWTRJyMtuK-1PrKzs_rNBIsrhue8XC5KRWVHg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 5142 89 KB
31 KB 261ms
261ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5142 42 B
63 B 52ms
50ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AlbcY5U05NUVf7JBF2ABrGbU5R68jPw3mE-GtO8Xc2-RMuUWJ3DbKwU3Iily8wm32N5stmFSC2y_1_4WykWT3Wzc_kVt9lB_FU2mUeLduhyBq58JQ

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5142 0
20 B 51ms
49ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=7964317497358541812&x=1&ct=77

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 5142 3 KB
1 KB 76ms
33ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15729
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 5142 20 KB
8 KB 60ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 5142 0
0 66ms
24ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS7P1mhA0ZALSX-xWLfEv0ZhWA0AJrNhzEIYwjD523xcemprkLAZSziP_qHvXmyKVISxnn2uK5PDrMsqu4zBBF53mvf2Q
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5142 202 KB
64 KB 285ms
245ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 171F 624 B
242 B 58ms
54ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNWdVo9ZUU0PiVw2QxKD04Fel1v29k6A97PiUTbn3A18KukGXWY1CDU0SdAMivn4HKyUgt1SkzHU6WUJfSqeo-_RQf7pWEnVtpIYHq9KSG8npM9RbjNyUstfmPWC0PTlhZwNRCf2oNzeDkhtLKrY7G4Li8ZazqbUX-VQMG96Kg2qX38X6LEnLBxaZIRhOJCihJXI7yjd8iVl58e1Kp7YhXn47p4Kvg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame EDFF 89 KB
31 KB 262ms
261ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDFF 42 B
63 B 53ms
50ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B4_CBylP_fW18pbQ-w2E-GrwA00QqfoOwo7ECS4u03nAc5N2Mg6peMeN3dtEGW2vV7NsiHPHgpI151kEZzYnvtn_wuskLhctEaQ8h-aCY_7tg4X5U

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDFF 0
20 B 51ms
49ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=8024944143517268535&x=1&ct=77

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame EDFF 3 KB
1 KB 70ms
34ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15729
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame EDFF 20 KB
8 KB 55ms
19ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame EDFF 0
0 59ms
23ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTK1S8HzCgyrXKxAeiryay-xp7lmutQhlz87oNv7aFKR-ZU4nnRuf-bA8hLFGA89frXajbvmLLJ9NiQlte7mwT6zc6xkA
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame EDFF 202 KB
64 KB 251ms
217ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3471 624 B
242 B 62ms
61ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNW4eHIWHgV4jYfPKyiflQhS-HWZ8HqD9BX-_dmvxsl_TdVpO8u20XUWlcvabxqCslwMS4AK8PjMLN7WfOGQ99Bq0UKZv0OOKW0V_6ckcFrxDWCx_40BwJ3n0Um3AxBsNk1ZnIeOg9OdTFjpVLaTXfz6Zd5ishhCHfP0rycCRwHC4IZShFB33MQrKquBsOW6ou7YEEXqpZaCZP7HKtAR78aW7enHSA

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9006 89 KB
31 KB 238ms
238ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9006 42 B
63 B 51ms
49ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AP6WaY-GRNqQDlD3BdRvguzBxSyoCNbSxf2gCSWwXPm-wa8gl7oMOqmvAUVMRH8w4RwaMrlzadCekg5yXd60GYeB73ZWvi0z7oDu7uQX_RfSDw204

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9006 0
20 B 51ms
49ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=8479604203345501977&x=1&ct=77

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9006 3 KB
1 KB 68ms
34ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15729
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9006 20 KB
8 KB 61ms
28ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 9006 0
0 57ms
24ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT-wRCUQA4Scoc3x6NWg19uB7D9_luxe99fd_--hUU7oV3OP7vz31sTSi_rjs2E9ABUkazyHN8_ag_wR6nvBkqXjK_l5g
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9006 202 KB
64 KB 249ms
217ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 367E 624 B
242 B 66ms
58ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNUboG4GrMXYxdNyRWTggsx0iUfBRutnjSZgLMA0yJObYo2p3N94KGzMSLEag-s89GFNB8qrvl2N9CswHhgOqlP2hA-iIe0BNiDn-12I5ixrhXbcg9QlGrni2v6YdaUQ0QMUpTDQCKdOp1mp5Z2N56-cF81MA6yWlV5ksQN5iL76OWHRkS4TrxNnaci9YssWtdSa-2kn-0AIvdIq7iV94LKwc67s3g

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 046F 89 KB
31 KB 232ms
230ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 046F 42 B
63 B 51ms
49ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CRNPUrd2iPxvoGuVTy2XgBxSVjSVYqWMcdxaf-7_DIp6C5X4tLF4aNVu19hGdAsApyLHUsu5UnFJYgMU8uo52gfIYhj9MnL0SOugVujV_1a_KSgQ8

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 046F 0
20 B 55ms
53ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1669276969057030180&x=1&ct=77

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 046F 3 KB
1 KB 61ms
32ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:38:38 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15729
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:38:38 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 046F 20 KB
8 KB 58ms
30ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17492
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 10:09:15 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 046F 202 KB
64 KB 265ms
238ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H2 200 p-fc3a8e1a.system.js Show response
tags.qortex.ai/cxo/ 2 KB
1 KB 198ms
196ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-fc3a8e1a.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: d1db393aae713dc1b2db9cbe552ac6b9a1b9452e1ccbcff3fc053e2fef7b9ce7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HEI5fWNvbpZUbWS1ikHtCLm0g06J174EaaHQnm32udKdhwfSW45hyFZoPYOcHT6mByM8rlJER9Za76Akrs%2FF7ulU9iQQwwMTKbr5U5ZgH2U5HSL5F%2B9UXM%2BHaM%2FOMPSpfTH037HKJQOlShMC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cde7cc479170-FRA

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 63A8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1

43 B
730 B

29ms
28ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjglrvGATAB&v=APEucNUhzal7Z1vMLmqdYHbvucwKgMBYh7HK6icDGJqGlK6YsmIVD3ZUH8mjaBGk1EbSracZMC4LubzmR-6dtsqcxUyEqX0vaFCiy0JJSqiUtEvF9bvMbfR8frq5ylp-XjYWhhR9Y0TczQ2--ZgXMqaghdgt7qI52QObCTijdPY2UzpUZEazVmdWRhCCzJqzJw_LF1T1cN4-VU6WJf51eJzQPNtJ52s1MQ
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8pxi1I4nNhWG1Cer5w1xoQRf8mYI5v4adZbjIjdp1oPAoqgOEhMdxUTnen7BnRswbLIvl2YrkWu8fsbu9GdFdSIR%2Bd6M7wetUryhY2i5uCcIp6Is%2FjDmaOBPwBGPe1EHgVCAKIkAfMBkZg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde96f0730e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 63A8
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVzGIIUV4la7UAB3lDSGngAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1

43 B
745 B

25ms
24ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjglrvGATAB&v=APEucNUhzal7Z1vMLmqdYHbvucwKgMBYh7HK6icDGJqGlK6YsmIVD3ZUH8mjaBGk1EbSracZMC4LubzmR-6dtsqcxUyEqX0vaFCiy0JJSqiUtEvF9bvMbfR8frq5ylp-XjYWhhR9Y0TczQ2--ZgXMqaghdgt7qI52QObCTijdPY2UzpUZEazVmdWRhCCzJqzJw_LF1T1cN4-VU6WJf51eJzQPNtJ52s1MQ
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A0SmPgTR%2BY%2F4%2Fg56MVpFCTVdpIYxJV%2BaB37ebsrhYmvcfR6Isizbt%2Fm%2BjsL7jzo7kTN%2F615zPg2A704TyDZ4LMnAkav7Os3%2FTVW9NVN%2BJTQjC21cI00p%2FyCmDJyGkxWril2t3Rw%2Bg%2BSNKQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde99f3a30e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 63A8
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

43 B
843 B

8ms
7ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjglrvGATAB&v=APEucNUhzal7Z1vMLmqdYHbvucwKgMBYh7HK6icDGJqGlK6YsmIVD3ZUH8mjaBGk1EbSracZMC4LubzmR-6dtsqcxUyEqX0vaFCiy0JJSqiUtEvF9bvMbfR8frq5ylp-XjYWhhR9Y0TczQ2--ZgXMqaghdgt7qI52QObCTijdPY2UzpUZEazVmdWRhCCzJqzJw_LF1T1cN4-VU6WJf51eJzQPNtJ52s1MQ

Protocol

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
an-x-request-uuid: 6beab2ea-23b5-49fe-ac91-6e70873e2923
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 63A8
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

170 B
232 B

230ms
37ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
an-x-request-uuid: 9d212e60-0a87-49a4-9152-19d3f01b165f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F57C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1

43 B
732 B

26ms
26ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUYJxq78z0gUnorrAXydM1-ZhvIXA-qbQFufH_R6xw7E-zPnnkH7NGjcI_pcIu9TjCjJ1gNB2lUbxM8xg1Qtat6TqhqPWxpBXYPWm2CLGFKDj676-ffAJ4yWCaq0vaNxk4HAMfGsMBZGSVRWfwNi0CYCgPGzJ5YCteQovgg1H72Mq5Z6GNIa8iEVzWTRJyMtuK-1PrKzs_rNBIsrhue8XC5KRWVHg
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZNbFxZ1zweENLTlYxl2M4ormGGjWEg7L%2FOOXDZmATpdiP34V6Wco6joVQVWg9qv6YHNRCrTYQ9nIGfZtXREcE%2B3tHsC2i2YlwmM22xpIpM3kpqHp6ew7Y20adCdLVxINWSUOiLg6Bn7eYg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde96f0430e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame F57C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVzGIIUV4la7UAB3lDSGngAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1

43 B
736 B

31ms
30ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUYJxq78z0gUnorrAXydM1-ZhvIXA-qbQFufH_R6xw7E-zPnnkH7NGjcI_pcIu9TjCjJ1gNB2lUbxM8xg1Qtat6TqhqPWxpBXYPWm2CLGFKDj676-ffAJ4yWCaq0vaNxk4HAMfGsMBZGSVRWfwNi0CYCgPGzJ5YCteQovgg1H72Mq5Z6GNIa8iEVzWTRJyMtuK-1PrKzs_rNBIsrhue8XC5KRWVHg
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ogmEL56eMjpQeP9iCyANIRmwBzjvFWR73WEJ%2Ff7MpLydWexP8%2FTeO2hifuEydmzniQvLibxD2oO9Tfy%2BCeIGtxHwkeUZyJSg0sI304z4PyEA%2BeopWFGxDehhHPKPqFvLXGyGcalkZEvJ%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde99f3c30e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame F57C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

43 B
843 B

10ms
8ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNUYJxq78z0gUnorrAXydM1-ZhvIXA-qbQFufH_R6xw7E-zPnnkH7NGjcI_pcIu9TjCjJ1gNB2lUbxM8xg1Qtat6TqhqPWxpBXYPWm2CLGFKDj676-ffAJ4yWCaq0vaNxk4HAMfGsMBZGSVRWfwNi0CYCgPGzJ5YCteQovgg1H72Mq5Z6GNIa8iEVzWTRJyMtuK-1PrKzs_rNBIsrhue8XC5KRWVHg

Protocol

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
an-x-request-uuid: c4b2b1ef-9bd7-42b1-8107-7386f9006e6f
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame F57C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

170 B
232 B

229ms
37ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:47 GMT
an-x-request-uuid: f14a4165-c434-48a1-895f-4805e75830f5
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 171F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1

43 B
734 B

28ms
26ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNWdVo9ZUU0PiVw2QxKD04Fel1v29k6A97PiUTbn3A18KukGXWY1CDU0SdAMivn4HKyUgt1SkzHU6WUJfSqeo-_RQf7pWEnVtpIYHq9KSG8npM9RbjNyUstfmPWC0PTlhZwNRCf2oNzeDkhtLKrY7G4Li8ZazqbUX-VQMG96Kg2qX38X6LEnLBxaZIRhOJCihJXI7yjd8iVl58e1Kp7YhXn47p4Kvg
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xO3BoZgPaGKVHaDPCSxcSlGhWROKuXmw3ENYB1EO9kdjUIpmdA8eD7YNrjiWzzbzvxFKVJ2D14fUXuu2%2FXQ9YuzuLlWGSADWBEW5ww1pOCNGB3PjRIDM0%2FyJ1jeT9zqg73t5r2bzkvqrGw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde96f0930e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 171F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVzGIDC2zpOnN.1UnXs5FwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2

43 B
734 B

25ms
25ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNWdVo9ZUU0PiVw2QxKD04Fel1v29k6A97PiUTbn3A18KukGXWY1CDU0SdAMivn4HKyUgt1SkzHU6WUJfSqeo-_RQf7pWEnVtpIYHq9KSG8npM9RbjNyUstfmPWC0PTlhZwNRCf2oNzeDkhtLKrY7G4Li8ZazqbUX-VQMG96Kg2qX38X6LEnLBxaZIRhOJCihJXI7yjd8iVl58e1Kp7YhXn47p4Kvg
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rC2hI6vG3XwW13%2FD3EoQJu5PwbbIkO%2FP9Ts%2F3ahHT5Jy9QJkhiPisCqEHFq6fdgfV9EEvUaDFZeCTYm0edGmaXC9Wem75h9mpJN8GqrEBz0i8nzA7dmaBgQWbR%2BOf%2Bln0hMsivarDV0Pcw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde99f4130e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 171F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

43 B
843 B

11ms
6ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjgyrvGATAB&v=APEucNWdVo9ZUU0PiVw2QxKD04Fel1v29k6A97PiUTbn3A18KukGXWY1CDU0SdAMivn4HKyUgt1SkzHU6WUJfSqeo-_RQf7pWEnVtpIYHq9KSG8npM9RbjNyUstfmPWC0PTlhZwNRCf2oNzeDkhtLKrY7G4Li8ZazqbUX-VQMG96Kg2qX38X6LEnLBxaZIRhOJCihJXI7yjd8iVl58e1Kp7YhXn47p4Kvg

Protocol

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
an-x-request-uuid: db2af16c-9285-4668-b552-7885a4716f23
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 171F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

170 B
243 B

47ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
an-x-request-uuid: b41b1e03-0a2e-4370-a692-aaa2ba821953
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3471
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1

43 B
730 B

27ms
24ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNW4eHIWHgV4jYfPKyiflQhS-HWZ8HqD9BX-_dmvxsl_TdVpO8u20XUWlcvabxqCslwMS4AK8PjMLN7WfOGQ99Bq0UKZv0OOKW0V_6ckcFrxDWCx_40BwJ3n0Um3AxBsNk1ZnIeOg9OdTFjpVLaTXfz6Zd5ishhCHfP0rycCRwHC4IZShFB33MQrKquBsOW6ou7YEEXqpZaCZP7HKtAR78aW7enHSA
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0P9q0IGwCSqJkPcb1jfWyq1X0UChqPfyEItVLd0FYYIl3CpsTZyCxeWdwmOYl%2BI5tPZFVmCsOnS0FksiPP9k7nz1gE2dS9X9gMMiUpq6O9QEFVTxbFU13Kh014OKw7qSfbviPiulpT6AMQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde97f1a30e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 3471
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVzGIDC2zpOnN.1UnXs5FwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2

43 B
734 B

34ms
33ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNW4eHIWHgV4jYfPKyiflQhS-HWZ8HqD9BX-_dmvxsl_TdVpO8u20XUWlcvabxqCslwMS4AK8PjMLN7WfOGQ99Bq0UKZv0OOKW0V_6ckcFrxDWCx_40BwJ3n0Um3AxBsNk1ZnIeOg9OdTFjpVLaTXfz6Zd5ishhCHfP0rycCRwHC4IZShFB33MQrKquBsOW6ou7YEEXqpZaCZP7HKtAR78aW7enHSA
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ksDgcp5Wfa0pV%2F%2BwzuyzhO4TWuvHvpleS8xXKLRvX8LTHWmeneI0U9Yh2ulZERB21q3B%2BcVRHbgBEEStWACYN%2FMsQuqdrfj8dAslju02px3gdTVdyEmdzVNmeozWAg310u%2B17sgRLnmUgQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde99f3d30e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 3471
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

43 B
843 B

12ms
7ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj-rbvGATAB&v=APEucNW4eHIWHgV4jYfPKyiflQhS-HWZ8HqD9BX-_dmvxsl_TdVpO8u20XUWlcvabxqCslwMS4AK8PjMLN7WfOGQ99Bq0UKZv0OOKW0V_6ckcFrxDWCx_40BwJ3n0Um3AxBsNk1ZnIeOg9OdTFjpVLaTXfz6Zd5ishhCHfP0rycCRwHC4IZShFB33MQrKquBsOW6ou7YEEXqpZaCZP7HKtAR78aW7enHSA

Protocol

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
an-x-request-uuid: ab94f728-5e1e-4a7e-9447-11a977b6c809
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 3471
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

170 B
232 B

48ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
an-x-request-uuid: ab3ad932-d1f3-4af0-8354-b156efa64c0e
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 367E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1

43 B
733 B

28ms
25ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNUboG4GrMXYxdNyRWTggsx0iUfBRutnjSZgLMA0yJObYo2p3N94KGzMSLEag-s89GFNB8qrvl2N9CswHhgOqlP2hA-iIe0BNiDn-12I5ixrhXbcg9QlGrni2v6YdaUQ0QMUpTDQCKdOp1mp5Z2N56-cF81MA6yWlV5ksQN5iL76OWHRkS4TrxNnaci9YssWtdSa-2kn-0AIvdIq7iV94LKwc67s3g
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bNJ2ofR37af6ErdXk4McdaJ00Qw7YjsbXZ89EqmAAF86%2FV9nZrPfjUI3jSvhmezpCDJQb%2BRL5kMEsDlzlSCp0kMLQcOlO8igciX5QbEjVYPdjQC%2FlbTpjUeo0tTJLmJA8IqF5Z0SvnrGCA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde97f1930e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 367E
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZVzGIDC2zpOnN.1UnXs5FwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2

43 B
738 B

33ms
32ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNUboG4GrMXYxdNyRWTggsx0iUfBRutnjSZgLMA0yJObYo2p3N94KGzMSLEag-s89GFNB8qrvl2N9CswHhgOqlP2hA-iIe0BNiDn-12I5ixrhXbcg9QlGrni2v6YdaUQ0QMUpTDQCKdOp1mp5Z2N56-cF81MA6yWlV5ksQN5iL76OWHRkS4TrxNnaci9YssWtdSa-2kn-0AIvdIq7iV94LKwc67s3g
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i%2Bz8THn%2BQs8hCm7sREr8u1H6HXRItQhssdMDF%2Fx3hYGjV6J%2FK5a2%2FqCsPJJJgmincsCHyxvsO9oSv2%2BghSx2AOeLPGI8t4dEwGk9P9tAX09mKM%2FUd2tOJGwHaMrA2hwpV2cxx%2FFu0y9sMw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8299cde99f3e30e2-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEF62NPgwy0AdtMUbzxfhcfQ&google_cver=1&google_hm=2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 367E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

43 B
843 B

17ms
13ms

Image
image/gif

37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxj5oLvGATAB&v=APEucNUboG4GrMXYxdNyRWTggsx0iUfBRutnjSZgLMA0yJObYo2p3N94KGzMSLEag-s89GFNB8qrvl2N9CswHhgOqlP2hA-iIe0BNiDn-12I5ixrhXbcg9QlGrni2v6YdaUQ0QMUpTDQCKdOp1mp5Z2N56-cF81MA6yWlV5ksQN5iL76OWHRkS4TrxNnaci9YssWtdSa-2kn-0AIvdIq7iV94LKwc67s3g

Protocol

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
an-x-request-uuid: c1cbc1cb-2d60-49b0-9572-57b2a05bef16
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEB5dMThIYPE3-_jzG_D6n20&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 367E
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

170 B
232 B

47ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
an-x-request-uuid: 1bb5c5ce-d761-4456-b956-e7c7ab3de6c9
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTQ4MDYwNjI0NTg4NDA4NTQxOQ%3D%3D
x-proxy-origin: 178.162.209.131; 178.162.209.131; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 p-31c577a7.system.js Show response
tags.qortex.ai/cxo/ 14 KB
6 KB 304ms
278ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-31c577a7.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: a87dab54792ca3697212f10ca3a1504a38c2c6d609612d0e3954824d2726a172

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d42QnyYs%2Br8JHeVnYvdZnZmWPHuzDlqKmVu%2BskiISd%2FEVa8qnkFkefskPFz%2F0llPEp13N3MQ9EIZEEoRX3%2BVQB26ETcMvbkHoKHt0eBQ4rHaxfobiK8t8Y%2BkIgd1MY%2F3nFNx%2FtMaL0CMbhmg"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cde92e8f9170-FRA

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 41ms
17ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 22 Nov 2023 15:00:48 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 046F 0
20 B 50ms
49ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5302387532144&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 046F 0
20 B 49ms
49ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5302387532144&version=m202309260101&ct=77&x=1&cor=1669276969057030100

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 046F 20 KB
14 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D3-o7b0LU8jdU9gDbfplKbNYJkQ3VASD3_8McWMjpJ1G79YZx0tgKM9BMBxWZtGKmqS2ahPOlmvmLEebIs9dMEQh8CRrHstBuHHTQhVsfo06oPsB0UsfiF3vQa9uJC3IsHaSwt6PLI94d-o8TOqLk2uNOdP6eOLffOPPHNATAWsuW7hMU&cry=1&dbm_d=AKAmf-BIGoG7jvdbXJOFMisBIPZHe3TJU1nNYQghfyb4yMhd1ldzovNAEfvaHqDUdXiSeKET7GRjbUgkOsroi5EiVF6ThqYNTwFaJKSprXsDM5UPgXaVycx6MC5UeobTbNrYm3K8-C7T42m_hRoxtDc4nCBoOX7qgn3aOlff5kmzRMk0H8h4_CHOh3WHrK9aR3qrgUHJhHjrPFtO1UBA8VafUFoT-L_C1oaI2J1-eqw94SfAFGFAuPIHICmPCP8PGcE690nMQNM3FSiMt0wkkv7bhjwKO6bQB-4yJ2rDCYrQFIsvHCLMi6exXz-k5eo47qquDq216D7R-MDmfkfyxEjA0AE5JpceS4R8Y7vNk49Xtvo7l2ObnjwvTGl0D2SJFzk0eQPU7g3TYABqG4Txqz4kJTbWu3D2dVCDnEu5FAYzMhAD5VsLE9Ga59kqDswQSz81MPY9lXoOXnMbp7g5YLBDlJAzA_plL3TJtoG5NPn2X4kcabUMq_l4uDLxtll-LJq04eUwg390-PwSvWZbPK5iS_Tw-o47rlqRVK_y_UEudbxMhnCb8mOjTFNwoAhvXlPDSQApHq1SdzKzGbTnvho-Pq8YcUilChKpuwO0IQvy93g3BATeALeWujnOFwH1XcTHVgVd_fxG397loqTTDM9nryku6CFFqzVA6Ejczm35NSq06MWY6SjrE-3D6lCEUBn5jvBKDEEKF5DhuPu772jzx1N4T_P2zvh-I0jGFrgMZtNdfMxzj2x11OZcPzUIJBv73SdQZ9liPge4myuPd0-pycUDjfoju0QZJEKMtCBN7TAuZH88-m2GTVOqEz4AwtaTAmLuHKwPdneuXj11smoyJLlOFMcbxP3VuczQiJBv2RLUiYwJjOvRAdzImohPcXpFceuKosH1wUDQdeViMapBrkoVNrVMjpJ-Mmy8gFtK8LazCy03IYoN-ob1AGvP4EXj55mvu0Rog6D8OJoOUCT4YLz0nD3IZ3hKTbVwBq9_8XMgNHS3uu1w8z2zJIQ0hvxXEMhLHGOopLhjjbyRRXECEoAzyVJfYPLduoJj1ztbGl8cPwJiDCGIV3LSNL7Xn9FHjQnLdolyfz59AzK8XXM8WkEoZRWmlC9MBg8XDn4YCHLIrDtN1-KsS41PLDlAj9Rexse98wsc_PN92ghOwxKiN58kbPaEhCpUdFARpzEC9W2Ind8c0bI25En6FqOpcTGrd1cTEwOd2p7i0p_uknfDNCJvFGGHbYRJ4NCiw8q3sHckXZfHmqEpYKhCt2Fj0vG1QY_xugk4_V4rN5KGcSZr59yzJ1PkRLloVpwG5qqvdJiJj3L2sZnO-n4Z7R31fOakDZBV92LeQpB0a-DVPraF50zSuS4c0eB7zlPpPYmUZO6-4CoJ2sey7S-FmTd04ukzquZMN684a2EfW66SsKqLR49onv4ecoC7C7IMpo6DBA-lvIiDMmFHmQH2R_0P38EgvPVs_Q48gIgP8b65GJ8u5W1ukvGiocGh_KbMuWO9jNQo_s5Nor7bMsuyPTXmTvASbs2zW-y2r07vnN45rylzA2s7pjDJrA9R-ZJXy7EgOTeXuZhQLL18MzyyuE8IwqzmLVwQvquS1MR7E8_Apb6B2cVMDdopHsD-l5o_75j-ZvabrHKoS1VYIgJ-JgG1z5p3t0c4JcoIePzELUiR7dC03NrikFa6gejgAJsFxl-5vODFFRZC9qw8zoEJTBpDowloj8rF0LDG2L_TgedDqMMbBEVHTXi0gw5amzYptswnO5oYAoH_VMpSQsGl8URTCFw-5D2WDPhrVJuAcaY_w4MqGlkyhNWFGcnRToXH_n01kpFYffFMWWYOwBsK2VToW_UyLI73gPFLSMgFRcbOqPPBInNTenj0YxbQppADtXArQSi2tdixpkUE_Wxr8nwbfUvWZn4TPLRASFzJT2MZmX1HLDOp1py_IkAz1hncR-QfJRi5BTd2GqLubRzKXAshWgeZv5UB0K8V8TGuaUTrlW8_3PUOF00ok6geF8JCzZqmMEzk-I_BV985ZqbIitKLW8g4WHUx2MB3oDB0siSKgFR4nF0uu9HuxqFz1KDOjOJ6q67YFzvhWWhJ5dv3kB0yLeLFh4pDbwjqURa12XhNFw_K403XQHQM14XX4wDwIOWuSdJjD_ICW8hji58ZbMCI5mLciDx0MxUzQuoA4ndi2Bq6nLZwD0ZsGwJ-RedYxmP0vXPWKqv1WazDm7oZptqfc-RD1qXKX5vDR8bc-jV5hNrj7Vs9yJ2iXYn5MQj58DhE3Dj8Yh7GZTVUPWqes7fvYM3GmSSKfi09BdlCS9KP69WT0jHAZ7jkdrC08tUGwqF_68uFQLlNjuLVdfYhqvWeC-TDK01AOjZASHIzHGYSdfXXgxWZyVvb2m4-Bz-ydR_peGAKmYK19r-TfvgmC_FRe8rLQEvkUNcDNQhUpusftBIvlo9nDpw3irKRDnfuDvBZ3TUIh6Rq965XA5NYLAikeeP4l1ble1M2YghrXHpMO1XxvvDyLRcB0Ho4FBF86cZ8-BG9pFRjRHDzdS1YtcS75CstviUjxxtO_Zmue5Jg2Xf0i4b5U5bGnL_9XYxfiVB8BlI0020YEoSGoP1CT7_3_wQzDXPpjVxTPUmotTjzV_X5BMP6H1HTjoHI873p6gkqt_QE-oXPEpRFbVhTUK8oVWqEwbjQy8Us-TOVgqKzPCxjepqekDNTxsOL6gclulQ2lS0UObesbKWtlpYwrqijzq4j39a1r3NpjS9QxbxkuQojaMyRqjIuuGI63Mhgz1NUEACrLxoO_8OuRmqPHazGLUviyxtU-F4TnQur5UtSPDXZQxiuOVNFMqCZ_YFhiiontvnYU-FEWFpzCXD-yZMm9tX81eU6bABRvZrfyl77tPjMiuEXLyeeaZdDDphGRC9YvnVxKTrpUgzGGGsG9HM7vGHukhyf2idrQaGusf5E5nXmoIu61va-VOzWJQes1Cm4xdayxRPMIJsR0VazQ2DxWE9k1Iqp4vL1nMQln-5aL4bzBxA40s7pdKrCmtv8UGAB7KXjLjx78D4rg4_IHncC9osmUvyZObfTqnzp4aFa1n5IGAXagiwrznK5w1Ak_RmgRiI0vjnEl4tRVTpDErOeMJ8EAeSptKDTgfr7lfXUlrSvOYChtNmFWdYailogrWdp5iK0V7YDSd5KE4Zb8mLX5NulqOquX0rLD5isF9WFpGueT6tEw6-AREQWnlEP-bl1dRdpf0X10uEi20mWViJ3CFOJOHImsQ9NRS826GvjoVWKbbASU-Cd9Q0UXAbeF3_HGNxfGsDfX2MAx3hlFyuZOEUKvcyuc2DqnrTEamdDpnpR-m0cFQVV8DErxPfbViRl21GFlm6Oy-IqaHGSi7ApHhIYkqJYGA7oJQo1GOI9QBXjQhxPl8YhomK3XTA6RfYABbO_pgxg_6BZf7NZlYxsCf-MQNyW4FpXLfBYTU2Wgcbwass9jnMKWyggYvcbyUYlsyHBwjcipqzJ3pc6pslyAY57gixA4swvKClUFbVmjBbwEQZva9aO2lBUtw2HFnO3-68b1hNQ-ug7zZHYuAUKMeLonHrTQmJrZJx39ORMiL0DcGmqumrMjcJOpzRvJeIvi_h7qh4L3Gvlupm069x68eNoqp29XikQyXQHmYVHZT9Rcr_-QU5C9ZD3TZxyMFKUk3dCtfvY_Dv_fHbKz-blDcdnKyaSrLD04wuyQR1ir1Q-wA9us8scqdujrAxaI2e3GXT026OrHb259N0B9cAA1zu0TZngv3ig_H1Re1w5CP8X5MGW9sp9Wq6rJdfH-lde_goEdn5q4FjsBB8DZ8TVajUN4nsxWNxKYP3bAJl0o9hjs0P4BRpQxQdHX2rA9-cz35XBNkFztJHlLkoJhjUJ5OX6BMEGxFYd7DiUVEsAZS8z167PxkwMicrjEk2IvTSYzl0GVJrIBwU6mZwMNOJ2cdyZ3Rx-iua2MZJaKVXFOl4H7eVFV108UIf9XJrifSRnoM1Tr0MunFM&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=1669276969057030100&adk=1033480531&idt=257&cac=0&dtd=25

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

708d98c555590e20d0844c41042af6ed64de0e0a453ef7c093711079afbb8699

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13916
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9006 0
20 B 49ms
49ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9567956802388&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9006 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9567956802388&version=m202309260101&ct=77&x=1&cor=8479604203345502000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9006 20 KB
14 KB 68ms
68ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DTeYc7uRZti_DcsqJqG1d0SaNLlMmnkry7PuqZzDcerhoJnOw6Y590KmfmHfgmG86PFFoKF8VGCfN4Qjcb0hcs2iQkmh5aga3CFsxIlqi8v688JUrxdTZBh0-gMQbBjszPd0hpMDShX7seCgeQdBC-1-pC6QtKhU-L7uOAGv7zkK_ZDRU&cry=1&dbm_d=AKAmf-BeAJkb2CfSiWK9tZJfRkUCyKptze7fqUnGPd1rmp3Ld0Leo-XkT21F3SZ_dgyr62NHVz5nMjdEAu1XUErmMhTUm7k8mOQTywsxqoEBAK7pJ1ctzoy_g2dDYNpg-dNLzw5iup3OqLQVyeWPndmRI9oP5PksN72U6zgBZgoVHRpESr6sJMFfMODs0zKqq7Ygj4VmgrTTgPivcurvoEWqJgtfqLPXa7Y6CnVWmAbIe4WGS-ICI--ykkq07P_GOH720DeD7aSxbC6dSGFfjRHluu398qx7yO4XUnxJ8_Yt-nqO8oDGBqvdzW9Sf4aHTxr9LOasHGQvVrxkwlFUsFMylvYIA9JsHSp6d10FNATpG-zJt7pMWSPKmRaYWBpesCn3A7HK458uWQOJ52mYg_yojMTkcvFYdG7ATlbNknd3TG8upso6qe9lKwKrJNmVQwVsJbE5QiqM3RPw9UIjH1jFSftygiTKd5Ffjr5eW236DkIw4rV3iQEmoOV7OQSzRi2-aFhxr0ExUJLrRvHMPZByuiIa6Inzk9_NbU3Jk4bbi4tGyUV6vLqtdpEqJIE0bzbtkBi2fL3sukk6H6vAHP7teJRoGIF2Nqpi-NIBqGcwLyy3Hmaq-cTM4cxH_LrZ_7UTJ88Cn_zY49OiP78rzjTyeYstl6XxLZLKziFQZsDLtskNrfRVIl0Vz0UyaB6y_zbjCJMzo0mBR_oBY9jKJmmxhmFl1938YaAGZKdEKyxI5Ag_qcwlQTo4bU2mcEiX3p2Gt8NcfY2vsqTADd71IGsJiIHFNVQDq8eTXJ9OE_cAHparM9iQ18VZOHj2b0fKW8HAQioF4p6ceAP1sRg9q9SLm7JMZaAoh99tkT8WGgOxR0sOTrDxDNV0R_2Lrtf-Upj_8_0xLJ_BcLbuYBRFdaGPSbj63x2DZkqmt8dsYo86sLh5r-IILnXw6oDfx092cPsyfWQVVhRDkobH3KBOWnIxlLECGV21AfYsRZC_mowsL-rCQ4JwIi-W_pmWxX2568pizlQZzNJdWjznWDaNvg7RzGTE8P0NhAHIAaB_7oJZ_zbwTGnX2I9pFqkRLwQFVAZdQmGeODS_oHSlPj0IxeFN6Z5yQ2f6Sx3PEzxOj7C4NFfShHv4if9068aNDggY0LhLjEzpkYdW3ExYN6VyGJkl_bvvmQDz2OuZDQKncjFDKZL7EKuzEFX30HJ4zYcT6Lljip9PGj6ajgwMxXXh1Oqpiebi-ZewOFG5GeGZUclknZQWx6Uo7LB2w1usH6h2uwV91wBKZRPI8-PoNvoCPw9-MkAI8bBMKqDSZsM3GIYk6AwKSP_l4IgBywLsIU0mnSbGgxj3oyuIeFB_cVdMftQFAWArG5hTLr2yYOWO6eQF-v9u6ZEvdh17ffe7W2izOpfY2qZ1LIgSdo-ypqyQMaP6DtgSQF-5plr4X0qQevV3L3IDf7S1AyNYUKFXms3D-jY7MirneQmSubImQqI3cgx5a4D5myPYLhoLxSDuaEpRgHUVxuP-WJIpWWA3vGrl27SPQtqJHZIywtPVFgP92yIXi6koXG1Hmy7Pf3vp_7yCAVFMX31SEE_6BpsTw_wp-ne0G1AjhzgY5o4-97f0PiXu8ziH7DC_fEWKhN0MwLlAGrnRJRCQUO_h_oZZvpUBYYtM6rSj5sTTmvQ3nrRxboi08XD8_QFPULzS3mtYzWNm4RpGTRM8loUo_0Q_B2ikXlGXv64mt_uxDR3k4mQgymC_DkGMBSMGu2sByabEB1SngJm4w7jf3B8euxNYJOf5s5JdgWaAszArognzFtW0sXk12iuV5nm_JktP7GJYABfQCNg0iR3TttKs_fQdujTucrpT4yM4mgvbL021VtaGBrzxIJsVnKfDG0LPzbjn_a9B7MfhhRU7euL9dtdF2mcN2jsiXt3Swxiws1VG4ywmwADRIafS2ZR3XUn2qKhyR2RTgAcgjc7H4mZUsSm4FpI1TxiPGuSSK3ebN7zBr9lRhgv-pXuCz8KG37-ulHU08p-Achrvz5eV-P-ChOMRF_qHB5s6Dh24rons6ZYDBuDUJMUhctWaQXrBs4uKT473faQ1mtuPMjN7qX4QFmgqi7syxzCKxCtXpdaUuQw34nkrY36PB_WRYqMXnCGY70scsPkwFIrwCGnK4f81G_ydvX8PFqLzE7SVBZanKWr8yPdiPqlieoxozT7o5BTuFfr8GZsRNM-ay-aX1NEK9PXF1mCkl8MBWQ4wskJiQWQSM6TtXypmBlYQe8wEUUf0j_PTt9l4bezjfA_-S96FPXWJxnnD_vndKuLMVgv3iigmY6xRexB3btw0wr1IrU3FhGyWkQg8abxdSrFFd8KiD3j41ESaYrtbR6bo4hHULEkpzeng2MZO3mgZO9K76XdGjjQvIKPjBtOw21HtExhkEck0Y4Ix0FXbfgtz02Ch4rzAo31caOa9RZx3TAL717hyW9DW73at838cjnbFdDpS2lUqe5zpsLVnrT8i2l5RW2w9KJwxSr9Rg64uisBWu0oDpnVQ_5fQrW-KzjKocJJwwsLGstZ_rvZejjdbMLp0E-RSxlWfjgZreW3ltwLYC_ALUX7TmXRGzz7-HcflSiqiUkof3xkOol6nV5lH3lJ2PD_YZdSozrPWWRNZMVzJ7fxBmBBiVg54ztpJs3-EzUtk40sfQdS3Bdx4-QRW7fvVH3eKpot_covsn9lpMh92SvZvWpjZFcDUNMMSXtdWdZFaLj7vouGQNWT1ha31DETqLGonZ_ljARSbIY2a3P5oyGK2VuP8iL74VyHuMGVlyDLLHF-PM7-5UrcrAtPZH_1zSdt5p7ddu_6SsPlcqZ_H-Lnsjc1ijAG97CiqGC6AWqJCgomatk9JqMbhRUh7JYkBOX14OQ1ui43nXAIJ8XPM004iJ4H6_BtiFKodsXOs7m4CGkTo2icDMcRy6hrtqrDNObRRVcjfRDrIzwLNgz8t16MUsoDNM39PlB-tQ7V6dv3K8IKIPlbzsjqiEYRsJ0ntE_2FsKGFJRzldGgoNWR2Cw3Zf5n2w2AE8wsyHsqqkkoeb0uULAjF-G1HxmQpL9CBFW9Tu0lEPebg5Q5o_FCVn9GkmbqtT5IliK4weaqw0sqzll9lfKWMNVXr-_5H1UFFIWxoc_qTAFjf00VJRPJ3gP5uazLTal5oS1uzoUDx8RtQt7cxZc9GJ4vQ8Y2L6luR1Va-25NVUxeE5YpjwOkSPyfXxZDfYzlxBGG2BzvT4C5w2cP_liVN07nhoyLVmg5ZMycPsly64S1VIwzodts0uNqt07S_3idNq6TFbdyvuRx6DD5ichoegCylKUDxmfQiJnUVlJIW-F3g5Hfuevla7YzQhFpr8LWQOBM9fVDYn32IMJWQBFPSddfrG3K-LdchiPWecSKGfgy__ToQ9OvuBhfH1KA5MnQz90iZeIc78NGURfsabEJaOEhLuPajLtRzM9PaAdP-lYFZfV5oVP2IGZ4NsyE3YTeKRbNUBVguhr9soZC9kU8rBbknHjzWEkYMb43LxCmkKIFzlpTzihdQE7E121KJz9ZBB0WDB0OCOISKkBWGI5TuiKCkpg1uhw4bFCpNpFhhEeL0Q9CyWTL95enp3VeECs75s41uYGOoL6jW_KS0KXWQcdPE6Nht8RZxA9s7glNAZyhHVnzrB-63wf4xMrOfcHSmLi7Ro4OFAw5qjIWinRcQB4bUONrmlOBQ-Hq5yl3dPC6sALeYm66bQK9vHHCdU2XKMyQIYmUTXUDTAPJ-5d9TNPrrIRMwY-J5k4B88040rd98a9AtLAPEaQdp3o_j_irdiFkYsyDvaJyEsB6T1DuJmphTwEhSEsvAYXlLjuMyY48ppHAS2OHvJIMEvUHy7DVhmstmKvxoJkO01DVdPgjSuEqrbd-yCokXrNIFW-M8k5-qdP2MpwFstNyh_IZ47NKC3pOUqPnpwLajEBBsMRCD5owsx4t6UOPl-vtIrpoR0G9WyHdrNVWE3KVNRhFZmkdkN--igB3wxLw&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=8479604203345502000&adk=3690638929&idt=262&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba78d4d141e4c4b9d520815123c30552247af7d1d7391a5c77b5a970b470de72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13883
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DCC3 0
20 B 48ms
47ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6586314330360&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DCC3 0
20 B 48ms
47ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6586314330360&version=m202309260101&ct=77&x=1&cor=2944434094795118600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DCC3 20 KB
14 KB 60ms
59ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AKAm-xEMMBb_kgLVUcSLM9OsczMKQxLSKOc3ZcEhC4tlCYM9R4SA7PGTolPShM5ES0ceJWt1KtXXu8sxOP2n9_-Kk5DY2waQykEzw6vWMcP6HpVZRSn1l6DsqGaErHBlSv7ZejFjkThnQYrZS1Gb8hmYzFwzXzirDtTFaxL6ZlCG4ypzQ&cry=1&dbm_d=AKAmf-CMBjS1W9QWusd7n6jcy0Fnsznx9JLvs8dxXYDDT1kqhhL5ZPtpOpixgybLn0vaF4pBRLCOtjxXUcupsiuC2f9XDG8VQIjPFm_EtxC_BoznsPPw0cEY03Y_5e_u4Bmr_ct_fjMeOKCIc12ZMwEFNzrNbYwTgdm4FCozErzioOkAl5maKFyDO--7zaVf0-zx1ikMlGvvhBDK3BT4jN62vYzoFiIFPT8mrOZVpogAKrzjSRntpVKyEXHVDw40A8VJIeG7WvZXOs8RU7Z5qVfDFDnzXYF2ucPzj_IKuDPG7Useepe0v_RraBI2fY7wsn8uRK0kD46WXe_XowB7yo_NnM6aNsFqX8zeAztRP4GWg18HUwvoMrk2ghkxinxO0yU93Niq-F0adtgUPWmfAQJ2jjztbW6oconWmRA5TFhW9YNjVXdbbO6wzQ_cj2uQzIU6Id8AEDGHMBOp50aV98xn-JMuEYroEy0p-OhAg8WYuxPvxVJiEggPXirWe_5e8IRg0gDVh9HEFXzAZ4iV0DTSWgnzHv2TuNWFVXAMFW1j68sMJO0X502OQR69-4i2SLya3gISGK8QyHSTLiake9HtyDvlB60CTcXZCCjEWp9ORt9ML3VNG7gYqAkuLuykowOV105kbnGp5_vBJFH4E3AT1ljD5L9zG_EbK633zz4RYxiI9nGmzIQscr6tRBjypmy_6T-1vVWnnZ1s4F9VY-Ch7JRcC84h2HXtcJwKXEx8I-fEu2dO3xfnU7FBisoIIUfgV7PVwSCQddmkWTunVs1H83XTpAhuRgioGS_XCjc1Cmx_TzQ2pUi39Jn3RVpMXC6tV9FPfnvj2Scy_dkI8LxCpfVpk2rB-IhbxH_SKIeTcv_6dW5Tf3mHGEsQppwvSRyfquwaP4AawWlKPtPq3ffNs8Bav-JeMwYa8F0rVqpnt2r1lolJuQZLrap9KeCggahFIeQ0ijCQVBDlWn_dfiTsohe8MLDX3g0eGWFe7Isw1pfjuN9Bl_8EFdhpObRjblslSfc_9txC8e66702CpwTEEEskjVyIXSCZlfKYfGwfgbBj3P-EMWNkCZ1DqO6Cr7JMX9TgkFmbVuzh4ymxKxNezVDJAjdb6r39m6YCZ6HdrVVYoqD8a2IQ24DavgcwgJieC5sgFKRCyyLErS7VwqIZsiiWOHfOlNjC0g3HhU6fN_zE7O0JOd-UBiv4xjjVixLeYnL_78It0Pl2NNXVw8AQYN7wTTV4L64po_mhorwtgXaDmCGfvqUi9IofsOJBeW1FuNXNP5YLcPqzHfzRezibbuQr650_ZbTsBQNMcd12LeNF3bOz77iqzSVuwf9TgJhp_srfntFCa-ENdYBL6ZDuMcfGyb1rxpWq-DoHCRlxndJJwlfeBj28od2a-W7cKvM-M1qhVvhVXP2TaL4bVG8KHErmaqE1ltvyIYvjo6IPRVikhJI9JiXT3rMxNqhd2aLo_QroxX9f-3fwPHdn4EYWJYzN8a-LIWizfLJIh4OdKehQzysaKHgRojbhhbcBGuBO4h1-axqHtmBEFe23xi444yjpoF-75eSI-cuRCeqr6IUa1134iuT1BPc-DXfCg1A9Sla4dKIzh1jxFO1N5yfVlwF5efz6RC4LNOcSR4BWtLDc_JgWghkittXKBjONU_wpqllP7QkNf1laRn7nFUbbnPdgK1LRzFytn5497tg7e79SErPj06RHRLnDbreqZX5IimyMTqnQe0TyFDmADYnOPwDGr9z-32bsn0mFCZXS_iusy6tLX7POVQh3f3lYHIkjiaVy6rU-m9BYDPm2mRinjevA-whxeCHMVG1izW4kKLk6K4GmRP31hRhBsCG-0t4vzNpzUD-tW1hk8p16EaWp_F5puLgRRL9P5WNj2H1WEGebvh4d9NTSZ3s4V2biknnR6c8qXnu1AV5NBLZze2mwfxWqB7zr-WtozK1LR56lrmt2A7-zHkI4zFRlYa3JND4jTXohVAMHSuUxw27ocd7s3Ha1rMPN8-YCzO3ilIPYAJy6MO0Wqe06-w1XOi7QvvvN8kR2954YJqzMuqQRj6gHT7v6FCDIednGrQKjRJukkxlf4JMDpq-_uoY86YoIWw6Eph1EAtmfFGaFuspSo57Q8GVmh2ueVBYskz11GI7U_uZAQJF360qXp1AaOs6ROqNgHQBkwE1I4_iRRBEeYJt7q46lpKfcM7tf6-hGkoxmoJhAVuxW8fHCytAMCCAjlvJt5eK3_bInksFoV86otFjXrdcd_RHqEe9XJf4NH2xbO2bJpZvjYTc9T0rvsqpmpi4lnFY4HUv-GcrqGPhItgWDNWZR0s5JcagL6vqFaiNfEx0gt488LsXOE4f7X-biMGZoHpNFSXk7NyIyATsbstb2x3J1xYeQZKuZniGrav5RP2jCrgOrKL2SyHHh63aXG1R8EOMTIrbMyEduhdEdvODQfpw_7GqFhB2TEXBdG-Xdfrp9QL7Ke0pj6wlCNcQWgamF8ywXRkyCaRmrcKNMd93nhynsjtWc8U1DcHcnMJgmq_4ByrMrh6Vr8Y8l6iJqti3W0C3W3J-9ZD8IGj28TpFCe3Yv4XZSKaGz-zVRER0WX8vQYgQcZaKC9XPOGQBVxJeXs1yLL87WXeXPoPJmKhe6yrmGqjUOgzBc_7zeObtwJIAJvsejnqFdujDGuwcavhDAjHhfog9NpLwdqTyYdO1OziPyJ-1DYHBmmYCEMVjBN1AztU3SQgiw3UNTfn0yNkR12Fyp2QnmIEk3L_ym7g4EASULbZx0n5COuIR-Cs0Q-KGTXrfJay2pPfEBhJeUy2Wm_6nUZBOsMKWHtE0FGisHuoLgpLCYJ4b3TC1gZtCAZVZVU2LZM9on7vV5R0tCXXkyd7tkjclsAcLMOF81VL67As4G7p-nuPxCFeOAgvFO-cYMIMRb-WKQNRiPtiA3fbNwCSKrNdnqUkiHJ5gs0lYzx169_iCpa3xTJwfSmfUubl8dI9J19UmWKYyLWCuHsi7s7pOvHrdrwRpaGxqtCs2dBKcCGyGhDGNCqxIcX0nInF6qecGavZfBOQtZFvDHaQm2Wx61N4dOUh-XpNW9lbY7Vjy6KaFjDUcQnn2KR5JPvTIpEBaa9lzoX_fKH08EXpvqR3uI3I1D79JcU0Gfp1rxFZZRjr60SPCQrKLSMFs-I7LDHFIJOxUaSr4AuhFTYEiB3L7FbuJ8mClimZbxzgU4_KU-IBHN1EGjO9FerFqkgKrues3TKdn8MQ3dYedISF27GCiG7uT2LWZwQHGPeqrJwiCWvVRa93ZswUWpSK6uR576LnZRMBthf0zZ3SO7Anmiyx9lrj_SVBpAxLqMqGPRQu0A403qPnHrBhWgjom6SZynR7egwiYyi0X1ASgDawslBpeKq5RNQuY4IWfJP8XLnU6py9U0bJgMvWDf96IxmwDH0ojwnzqRfk1ObWyb1d7Pdtvako5P6Ys2Ab2B57duS761KcuPr_UytThvJt43MWw8gd-RwlNoy_EZxR5lpd5YsJcFem-2oMI30LxKj7_elp6VbpA4f4uAKdpVly-ZNzPR568WTYapNX21pLzLHBTt56RhbiLNg_wWqVJz86Sf57f87_dTgqRHBHDpsTDCtZaeuJX4izfZ6B4-BVlB7rdkKBbOcMT8eegAhHL46aQGnSm3UBj2LAGc5WK9zNHfV0Aj3JvCmmdUdTtBBrLNOKkA3p4qWs8CIJW6AhU-L4tSA6TrCLnrtG5SS7P6VeUN3PwOr1LxfFi1TOieblEI2L4NIkc6UHvMadQG29PMBghDvrU7SVJOr5VxN-JRqLm1upV700mFuYhpvI_N95DGQU0vfbI6PZymdZBksBQJ1F0jd9ItbYKrfzApymaSBX1lajr9JpmvbQPlNtJ5rjo2y2H0nQvJHO9q6Zu9XrbZgZvttRtUbkamBdm468XPI1KRWcCfyuml-NSw79Dp79EcrJNXyGN1g7NK516qj88s1hF880HtZd3DhcwKJUVb3pupZqdh3k4-bGM&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=2944434094795118600&adk=2086295851&idt=278&cac=0&dtd=7

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ba258b4b3e78d8ccfe8cacba12ba9651975686766a03ea823a8596caf01e13e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14086
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5142 0
20 B 49ms
47ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=687316808538&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5142 0
20 B 49ms
48ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=687316808538&version=m202309260101&ct=77&x=1&cor=7964317497358542000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5142 20 KB
14 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bd-MeHAalwLruznTj1ACLt2Qh5OLbayss5rIXNZaxVJbBFKm7lljySu05W-4RyhuXoYVdrt2sC8RlunaJZVw43V4YAwGi7GOwurA5W5nUWO3uY6SomZDcYzr_R7J4V5jhDz9fV71fWn0v4UQyOyXFO9ipkxNKwcbP6g5dv3ge1Dh3Ryqc&cry=1&dbm_d=AKAmf-AAwbbS4fVn1MuJJk8y9mSHk7r98ouY63EupejjY08oYJoa8iILEbeC4PRcst4AE--GcMglEssu6tYBFaBju4QRdMVyFsBP6XwB1AIuWJ12w0yRf8FtO48IrOcIVqRmuEqFprJQCe_cW2fkJ-GBQIFWB5FJwSi2fy_voA8fsWfg2Ob8YW6zDC8gOLNW2wvpeKp_3llUS4EeM3cFwuieLLz1YWzOnEOjv-14J9RaTSFW79yqT7FcxzhiCy1rvmEmZMFACFRNGIyOGdr-DdsgMcBO5rv4rEqnBepOnV0KICCpmhHbWZJ27LN4u6xXBN71-wybHVnAEQIloEYVlr9ykfp8bfB8RS9imWGLbPaekwPqWIFlu--No-QXugX3gBOuXw03DtMuSi9maOv2XSv_zm6-yrtMFjXfSFGM7qTkXGAVo9x8HqLOaWJkWem73Wgc6dcD_KYGOrpJMLYouu0kfHFZSWzngG3anlC1ALLm-y6nK0OxAi66j7-k14b7vSWUlY4DkhWVc4dyZCPuvp6HO_Bs_t0y7ie78QajdqU4ipMHrpz8-TaZdLrmvx69X8P9FGe-CsWAM7BIyItPdUkCVb39znIwV6FYRjaJQsWihK3_KjDZ7iPnxYqx3kRkYMFw3O9uCiDGeQZq101s6MtIP2pThTpZJQhURpbAx0Us0Zo5Ph97bj5A8VIWJUufEHmyYM32Mg7r9jUgdDSoV7llf-kcwlTA-R_hzYRLax37HhEcVzQkC69Bqrv0ZtkV3-tQYFDrpgPin81FVHs0_3nGBlNzvQu0CJeeZ8Rxwg4rYfNknRL18ekKl8Fq0MBZqmcvAKmFK4hmkHT3VPad5vUOZfh5s37B7VrwslAAK_G_J3GHuI2Y_-M84nRD0JJW-_CvZ82qSQgDTz95Zk3fgm_eHNiD0_RpfGqT6MuEV-QZpQ30dHF8lSn36p-2Mrg92RY_ReO-Ttu9oUAKDBz5r9xTiTHFLJL8p-gf4PYeCIWoMSAjUZzLlT5WUo1RGnch9vRD6cQ1d81Hn9m7YbO84iqBtkhAWr3_hJVYIVAJVhdGhK6YBHsHGdqjRHXkVsxXUxwyJ-ozQVtTI6yr7dc36IUNJRVnL6d6k4ikZeAYRDTt57T_FOcA6gH3CeImP3eWf3keI7wRvAeioNuvRVCkOQ3ibqt0g46cMFco53llycRMEiv1--Od049lbKqwfzH4PqXnDDXY1k2hyNWvrcgx58qQh6f6SR-bAzWwLIInF8YrtNOintgaY_q10GSIgjWAvIO5deofppIdM54MWyyGK5cNxXVBHGwbJLfOHuLdwoOgHCYovzyEscmVq2XCmiwQ597fbDCIIpwCQwFE0pyVZoW5KtVx-rHyC9S02ippF5_nSVVNeBIg66NXN_tjpRDQPPiK1uWJ_h_vWRlQ_Cpae4mJfqqwub57AVlctcaXA9qDOPIvGb10kj3g0HYCXRw9cf0rqNXo4XBpUYIZtRGSwCUshmPWjfTS5qnYXaZhxDI95y5dB575jCr1wIDc3fVxAaB_0Lxnsg8v1FvfAiXLLXZk-NWbt5AraiSI9cLUfnxRcJd_aN9tyVxDIMX3Co_VUBQW49QEKkoYgqDRZMy778P3A4mUqzQ9lVjBT2XwmLN2xNJZPyMy3M_TYOGNJW3mba8EGDhorukSJ7E13yPCxPZTt6qsCRI6ylRXA3A_xpbqO2PJglEP3vu2cNk9-wk5_PluHCZHmSE2QMTdHHpUK6bbIIX01CJ_11ZLGVAEdxuSo7fcH5nfhYm47s4AHfcbLi3LxRJhCmen3Xk28-LB36_Y4JzSBiXIaIH7bA8CKmQz9fknenPFTIGOlDmE-VAwOtd61Qha4_XBuS3YptvuPbLHnN5JbHrouSLJ82oPl0-KYpUmLvuGNpmwgCcUD49cl2R7mADfjf-qEtcieIdf093rFz3DOOL4jpQ7rHKzZVhYWRDmUjtr4ymYx6p1R1oGnB-IgK9uWYdGUaHbfQBG6WSm8Ho3AIMwKZayn6OPKfg6J0Ea4Mu6tZ_eMAVxfRr7-9ns9JsEADxFldwIotjoBLjFwC6jAmoLvZ93fZERL7oBLP7gPUm8ktSSv5GVhJ9YlBuIecl2sOE2nLJJDcdEMitk4LSBnrMpJ_4tFXRlKgEy5f_4xGY7_QgPq7sDpdZj9rYK6wRl8aM2xSisHl5y7tzqwY3f79wxA-Q2hBhfta9OGUOL8HGNgkm4u3W3AwdG5prTNiHwyUixa95kAj45p4nIEBnvBLAFFr55KbI9WXN0o3oF4K2plzzcQSYS2IulI2mCWDpsJ-dPvElwv2H2GLhHvTVlCurj9C6jpZJatfvEbRnNHLadWmZKgDFk9ETSmhW10X5O10ErvaW0RNoe8FBmVAFbLn4XgGtRsPAUrxg5TB8-StE_YLc1eC3_2DD8UJuW6wQEpJDOpMRI0JeMJZ9tUNkKPYY99P9DGBG0_Qz_Vsh_IVQZZ9kAdLw3ZRgLa9buwNwGjDwb06nbpbwrULI1twEEo-zgh5aKtu2qXmcxUgJMxChvPAiY7DnwNY6tcO3RiGwJH7HimOt-cwZ0XGl1qEe6F16cYNVMb-hT_bO7ty-PCJ-lDWkrk7Fs6-Im6pJE7D0NlcjmYbpkaJ4MAfxGHgEwNpzj4osfMxP2Avt99jTKUTXgK4KKJGqbuhdWY01aFN2kM_Z2LUnG6twJYvMd3JwEQnf4cibmgVmLvdVwcKXoLNfU5JXdKKvGZD-o8_K6cemVZIDb9mcjEUekavXxu-phckit99AmxxmnH3mkeOlyxcpR9PzZmZtz3i1NTxAuw3rpseBS6fo4XDc1sKsiVLtF0kK39BgRCIydpZVDNcfb54csFGTSZtY7q4YjY86gZTJpppV2oY6uF3HJ1f8qWCzcGVLTD2CCot0Msy3hbmfuFdk5bGR4-s-Pq1AVW8_wGYV_AOez6v5WfOcIKrnnkRI2-lmJOFH3w7r-Y-ybrPgOJf5Zzs_Pwv36yHmIxe3li-eYhSqpj9-DlQvtl5s-fy4tRpRM7hojbhMQVVOffXY9wh76eDR0oWSZH_UZQZPcrW0PltuyuFAfpUmyB1MUpsNJQA4Jp_wXgxE5JH9zjZcOHPHf0zNba4BRFMU2_bkZ278bqI9AkqkYIxZtx5xIdSD8dzk4NGWKiAB7s6BJX2OIjnK2JV3JL7fKobStpYC-OQMBSiq3gu9EY6oMrm5B_hu0InRMf2cPBBaJ9FnBkUGeUHzsXuk1b0OWWkMRb5Go_yqcr29fpCu9ZpljE2HcR5UXMdrq8sYAooNy95zsHAJezDB-Lk_9vEgEc7hTlBYmIV96gM4Ts52zupM4M_grVjKcJDFuJ6eXDCg4MIQlQdLr6EszsFRT_mivKWvBWT6-mqavBtrg8zrGII3AZYHqHD9H6xtI-q6n65beDwin0yDgasT75qG83Vg7etLYx8LphgTSFUmIZ-kU-IUusEYZTvqxbDs9nSREEa6jPrqFUSZQ1fF_ddP52HkvNyfMdEZxsgmJlzrOqifCkYDv72e_S1RUoeFUfiJx4U3I1P3O6HO2r-iol8EgxKyhJKeeKou_vyMOksU6KQOkCeb4sLyYD5CpMa_4FgBAdeuxdDzSuz4RhuEW2h-tTzFu7dL03_FbuRWuF4OK9MG-EdrrZDyFSWO5eck1EiEgO0GfXxwA9HrmR15g9KQYV5sTc6jfCkSg00WKT76o0AV4cdDmId_k4rVNZ1PjsiSh1EijAGNjDFS2_OJUPr9Go3YrDtKrjn-gt2OrU_jmzWG-5FK7JIBWIhS_sW1phMR3EYSpRWRkTc_JGWmwG0ThyxmGt61teP1yh3jPioeMMGT7Bmam7hplHfJwrcIRb29nBeNgjlrfgtpoJzc52IaaXYTBHFBQqjEImFTa_-jItsEA4Hale9EMBArb54cC408BLDEth9jWJ5fXbpNuOmp_FZAMFaKq3nzBiyvEjBkjQbxuPoXNMB0o9h4AcTUB6UW8IekURBR05crjvNpcFu4&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=7964317497358542000&adk=3944675600&idt=278&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cdeb201923b773eb59c09c2b46b7797b6e4b1eedc439ea58dce0601052f73ecb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14156
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDFF 0
20 B 50ms
49ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8993595916137&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDFF 0
20 B 51ms
48ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8993595916137&version=m202309260101&ct=77&x=1&cor=8024944143517269000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame EDFF 20 KB
14 KB 58ms
56ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AZ8l27WFwOYkhWytXBzm_82b5yNQdBfvN9wnPvkJdqXiCupuEFxdPGnRSjotGm4xSAqBfhdy6PyDfkfRdxDMyBIXnTdTte5r_N-iRPbKtlaIVuBzqtDjVkZHqMtONGT8zC70kmFsRg3o-a3lmM5g8owRGNdhMJaCDX6ks1JFzM2mGA9PI&cry=1&dbm_d=AKAmf-AnE_IwNfmmi_Tx8x8sVDMXMGVqVE637z9OZEE0sG04utAiBJGyODNF-v9S8c9dcN1oI_WQHXFCEQUZ0OGosYyao-rFO9vOFYdOA25b9VPzW7LeVhzKiGAX1lbQRV6OByz3bxiZcX9Ux7ic7ejmIkoCKmcrBjYqLGVfklcbvBNjOGJjAeWeqU5NVBFxjc3Z0wuBNz4dkIFxLqy3W_TdLsuCXwaqK-iMpcuLeDA5lRrb2ElJ_psChgzqSXi87EYKG7YGZKifdW1c35s91_rZiPaDo5bdsiw5TrvuZcwpuM1d8mIm2oks_d8gTXIhIm_VYkhIQ-t1bereQqN1fMgcgm74gZgjaHU3xiNy5knOfDjHabgbCiZWiIJi0LfQ1vEgPDpHqAQhkjruKymq0MQcrjycRxlmXI8MhzcKX1BXYcOSeJZz_mbUek7DMsSJCmUbAM6Ze-knIp_pDlr3mN-Erp_jcXO-SB6fH4B6OoYRuaKySKe0PeSy3HmuxtAJvZtNQ5DXkXSqjDBEZ-Gz7MfWmXoS4FSAtBAOOCtAotLKu-vGd_Qlu7E1cXTJPFlBxjN7J9hz9-RNbo8NBLgBuy1D4luRoeuKEj4HAnFUNs0gKp5EQXME3h5BVUnNfVMe3uEtpCO_q_iSmcpB-6H92xiGZOseSXBpgnsa72O_-j8aPUsJ953ri-0fJ47Qg2qTioNFAbBCfNLiUJy_mJni3w16znn2xR9zRGxbj1Ph2frNNbku1zJxm-lN8-SBJmeT5lMwraHTWuEEBTlL8QmCeM0RbbF7Lqmbpp-1Wjd34_xThhJoM13lXNpNkQOA8Gu91QGtUXpwWwi4BDh1cRwvlgIt6sYF7lChReBOeawibOR3juJ4qk2GoVPxgVgjruBRIMgBzFD2ioliDauWogqT6c2sOLO_HOvmV52Qk21QlyhVxiHF0G3wk_f0cNXg11dNcULYNieAtI2tbZRihidBMFaWN8idExHaRRj6nbBKaIKKPqytEvx5QBrDNLGwqVpG-0ZWxuuE1CGVpbsFV7Z06EbyHHUz_UZj4HunuFK1bh6GxSUbDZZtMzqjCoBaxTd0FWQMWloAYFLCJoKP8iMVvrqEpUtvs1tKhmnj2KYbgAfeAHRkliZXUjkx1ftOMmeIUF0mev2k5bGsUZQV9AV_csuR7VgbcsNf180qO2Cpsa_sMKiXlDs9FqiniZpHlXFYWhzgQJ1AUgk8mHxC0nFXWnlewCm713_5UK7j37335MwpKMdirWDHvMgUqRLaCcu88lUQhDcODe4Nr8dLB7oEkd7T-9JU0KdQUgu-tzk2vwLP34vqFoJ2BqwhbYtGNgz3RnXoyV_gUoQY7TBW4dIFWCn2IPyKoeOa1_nGC5Ai6_pYeVKstuFNbbjJ-E1iFd6ThJuS0IBqk2Q3ZwIcALM2gyDHKNX8xi5htcxrOgU_C37Fcao4fkCT0hYgRpH_6mNnH9p77FjIkbReaGKHgrEorxVVd3oKv1HCugHYr8KFi85J-DkvKqiNiBc8O49mYTqxhesvJ_GX8_h5VGWzORB0g7ht8noy_jqgBelf8R2HN-P_Pz1gkY3esyVKhcwSwFdhO7XeGRsTEwiaL_-2cx7xlWkKuCFMZ8AvlS3a-rOHz_LWx8o2U29HYMrao-8RyKa83nBpEFi1zl3jIRiePYEDkUNaQ7rMXCfG18b697TpyUy6aW2FuxgpFmN3mTsIBIifkTT8wSoqRreVITECfqnNpXy7uDEptqKOqsrnD-Di1PAbxQpVtxl5R_NPLs5O9Us85o7D13AieCTwc6MpnrvVzA8dDcE9REcO93UOrXf5-Ccpa42mjLfmYZ8bF4719BJhpq-Vldiew_bcdE2wk84EDJ6NzjlNWZdXtylp0X6QPUljgbhzjY3E0ByHKBL5deUnYN5gl0TvTQqzYhi_pCEaMgkIyzQasBHl4n9r_WGrRkPIJFIBVGiAbjmVtAViTtjfeC8lvQSxMps2LpF77ONMQo8nE5R-Bk1k4mgtccAopr9UGRo0InxD9aMDTYuKk3OD349I7L9XXdFq83-xOmo8gYCgHblMxySOIPFG0C9ncwW9bUYHK4snRikU7Ixw1iqfz6FZ02lWAh3XeM7GbnDOYOPdrK37xBJ1XI4GKrwo8HQ0RMhrn29T-0umYYyyyQ3OtNNtvpjtmBfLr7zeEuBKixu1SUPTDN8nc_P0UMu4xjRVZH9V0E-INFVOE14YBa62rq944ZKXCDTsp5jVrY3lAEBHvp5HX6Uu-ZYjA0P3GCK7yOjKI0XNmuCaLAAw7l3Z21vLqYUv7RwnJVSgful97rfIHedf5CDDGFSxPSMM7-VeAg6HhmHraZTF6JofTTItYo_0Nj6Gvu2zShrYHX6vUSwxspLstuN6htdFmoAcYQqV4vga67pB2X_0vFnx5a08C07K-b_5Ra81SyEfWAIHy9F8HYNNSVUbngSME7o1l0Vvs-2wTmMngo1EC6f4DX42mr3KhQWSUeAjWJnT8Ee6kzZSM5Q877Blnhb811YoghPLbAF3LOauQYzxBqCvBz9lpSpSG1VKmlrdhjrKs5GyFrnnSOJdQMA1nPmPeQWBifbh3uBwhU5dQ_y18aTsT-i4J0Lo5EOT3GH92-x8jNNY2cUn7CM77zctGC_wtxCC0NDQPhOpICVxLo2uJS8RsLOs1bIhJkTy2NYAjICknxFOJFKxlPyZBDaPp2v0PAIpJgWF9G4ryMonClqoAmWfku0GHG9edEaC-O0uZM8Xf8HraMBrrdRRhG2f_axZbwgi6WGdb9EJ6xLP2ls-DC9D66Xy1jAtV-DZ2y8sDCxGQaXj1KK9Gb4UolEQC6KujciHXeMhi6IAxUdazzxDcbqL91hrLS7hosk0GseW9JnAf-4w86Eeu-KBj1FgRfkfiyJPh6akFeLTCewYxJC3da_tq92hy53S-F2nm0nr6DGRj157ru7hr4WoBQm664bnU-wd29sK9P2eohX5BUyi8LHt_l748zkdxzWzHKatLLDcLVMkvqGr2o2T3dVSFi2ahpENlfZjO7iRF3XARbN2CDRoK9izrnI0YwVIQUeR5e4zhI0ezlYMcfayZ4echXGLvOcwubwxd2ZHomMIbu7RkuFhoPbvo6WP2r9JrTz0UQZrSd6HhaU7Ib0lDUDk_CJwaH2WlWp8u8l6lS1huY4q7GL-y0rKIfVzxelf_94lhJvJCezAt880JITbDQfGFhWcvkV4_4IBDp-G7OXx0q-4HIoQ2oOluDI7RQDO-zsvMTw3A7tgsEHpE0dVTYvRd0mNLpdFUVReSWgluSe-y_eiNxYFurzayqN6vxzfRS4BycexcLyEz3zR5eXQsPk6ReXUuaYiz40d8CUGwlBi5hJfeoWLi5NLvwQy8QGJO9m_Yp7BtDhuq4Pl83ik_wGFje_JqpokHCFeYieJLb-kn7nYDzsWAlN73eH-SCmnuRk2_OWPJ5Dms0lC_4fDgbAE2cvuPPzN4tJQu1oceSIyD-5Gk1heTeOzXgl_3skJBiac3vQj0L0ICFTq0-MnpjxPe-AO6KJbbSfGEgis4DZ3xhopCRYvTMRUi8zz6CVFVvhbOS0cxwxdHqVemNOHMzd-BAW1Ag-l1K7X9aofeBQ8e7am5FRFrL7pcfEcRVHpDuMdwRpJOZuB9PRRMbGsyHWL51UdNWJ3SX6mDJFSPqLrpESDtg_OMkBUFAyn0mTSHLKYKwnSgyeCJ2OdxGWDwOj_eI_fLgMSGGwkdMfmmf7s19zpDzXz5wIwrDYiBUlP7B-e0NzHwDEAi6biIjWhugBGPgjxKAbDQ8sLVQEgSnIZE9IBcbwsXZaZzsWGpq4JMza1dgGZxpxBpSivgjg4WlkBBLOmk0EWP5ul48Om2WVgSjAEdv23wtfrGcMVLzcaTf8BNFavC0zUb6Mh3xwVbzpxMj1ZG1NEJdM5i-37dPVh8kr8l-0lqvlZOj9YgltBCM68H70VRFYLJY4dLjYOVKMw-6EGlgIlIsVmthba10nvlYI&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=8024944143517269000&adk=943508955&idt=275&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

76a8555a200bf1a6db8fa930c1f876f368ff7a299520b01b7899e0b545b21564

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14051
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.139.js Show response
static.criteo.net/js/ld/ 95 KB
31 KB 54ms
25ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.139.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

139b31c08f90a423ecbc70bb84529127db75894a8bb23c4858e141f89cdc0a32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 26 Oct 2023 13:53:27 GMT
server: nginx
etag: W/"653a6f57-17cae"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Wed, 22 Nov 2023 15:00:48 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 046F 41 KB
14 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D3-o7b0LU8jdU9gDbfplKbNYJkQ3VASD3_8McWMjpJ1G79YZx0tgKM9BMBxWZtGKmqS2ahPOlmvmLEebIs9dMEQh8CRrHstBuHHTQhVsfo06oPsB0UsfiF3vQa9uJC3IsHaSwt6PLI94d-o8TOqLk2uNOdP6eOLffOPPHNATAWsuW7hMU&cry=1&dbm_d=AKAmf-BIGoG7jvdbXJOFMisBIPZHe3TJU1nNYQghfyb4yMhd1ldzovNAEfvaHqDUdXiSeKET7GRjbUgkOsroi5EiVF6ThqYNTwFaJKSprXsDM5UPgXaVycx6MC5UeobTbNrYm3K8-C7T42m_hRoxtDc4nCBoOX7qgn3aOlff5kmzRMk0H8h4_CHOh3WHrK9aR3qrgUHJhHjrPFtO1UBA8VafUFoT-L_C1oaI2J1-eqw94SfAFGFAuPIHICmPCP8PGcE690nMQNM3FSiMt0wkkv7bhjwKO6bQB-4yJ2rDCYrQFIsvHCLMi6exXz-k5eo47qquDq216D7R-MDmfkfyxEjA0AE5JpceS4R8Y7vNk49Xtvo7l2ObnjwvTGl0D2SJFzk0eQPU7g3TYABqG4Txqz4kJTbWu3D2dVCDnEu5FAYzMhAD5VsLE9Ga59kqDswQSz81MPY9lXoOXnMbp7g5YLBDlJAzA_plL3TJtoG5NPn2X4kcabUMq_l4uDLxtll-LJq04eUwg390-PwSvWZbPK5iS_Tw-o47rlqRVK_y_UEudbxMhnCb8mOjTFNwoAhvXlPDSQApHq1SdzKzGbTnvho-Pq8YcUilChKpuwO0IQvy93g3BATeALeWujnOFwH1XcTHVgVd_fxG397loqTTDM9nryku6CFFqzVA6Ejczm35NSq06MWY6SjrE-3D6lCEUBn5jvBKDEEKF5DhuPu772jzx1N4T_P2zvh-I0jGFrgMZtNdfMxzj2x11OZcPzUIJBv73SdQZ9liPge4myuPd0-pycUDjfoju0QZJEKMtCBN7TAuZH88-m2GTVOqEz4AwtaTAmLuHKwPdneuXj11smoyJLlOFMcbxP3VuczQiJBv2RLUiYwJjOvRAdzImohPcXpFceuKosH1wUDQdeViMapBrkoVNrVMjpJ-Mmy8gFtK8LazCy03IYoN-ob1AGvP4EXj55mvu0Rog6D8OJoOUCT4YLz0nD3IZ3hKTbVwBq9_8XMgNHS3uu1w8z2zJIQ0hvxXEMhLHGOopLhjjbyRRXECEoAzyVJfYPLduoJj1ztbGl8cPwJiDCGIV3LSNL7Xn9FHjQnLdolyfz59AzK8XXM8WkEoZRWmlC9MBg8XDn4YCHLIrDtN1-KsS41PLDlAj9Rexse98wsc_PN92ghOwxKiN58kbPaEhCpUdFARpzEC9W2Ind8c0bI25En6FqOpcTGrd1cTEwOd2p7i0p_uknfDNCJvFGGHbYRJ4NCiw8q3sHckXZfHmqEpYKhCt2Fj0vG1QY_xugk4_V4rN5KGcSZr59yzJ1PkRLloVpwG5qqvdJiJj3L2sZnO-n4Z7R31fOakDZBV92LeQpB0a-DVPraF50zSuS4c0eB7zlPpPYmUZO6-4CoJ2sey7S-FmTd04ukzquZMN684a2EfW66SsKqLR49onv4ecoC7C7IMpo6DBA-lvIiDMmFHmQH2R_0P38EgvPVs_Q48gIgP8b65GJ8u5W1ukvGiocGh_KbMuWO9jNQo_s5Nor7bMsuyPTXmTvASbs2zW-y2r07vnN45rylzA2s7pjDJrA9R-ZJXy7EgOTeXuZhQLL18MzyyuE8IwqzmLVwQvquS1MR7E8_Apb6B2cVMDdopHsD-l5o_75j-ZvabrHKoS1VYIgJ-JgG1z5p3t0c4JcoIePzELUiR7dC03NrikFa6gejgAJsFxl-5vODFFRZC9qw8zoEJTBpDowloj8rF0LDG2L_TgedDqMMbBEVHTXi0gw5amzYptswnO5oYAoH_VMpSQsGl8URTCFw-5D2WDPhrVJuAcaY_w4MqGlkyhNWFGcnRToXH_n01kpFYffFMWWYOwBsK2VToW_UyLI73gPFLSMgFRcbOqPPBInNTenj0YxbQppADtXArQSi2tdixpkUE_Wxr8nwbfUvWZn4TPLRASFzJT2MZmX1HLDOp1py_IkAz1hncR-QfJRi5BTd2GqLubRzKXAshWgeZv5UB0K8V8TGuaUTrlW8_3PUOF00ok6geF8JCzZqmMEzk-I_BV985ZqbIitKLW8g4WHUx2MB3oDB0siSKgFR4nF0uu9HuxqFz1KDOjOJ6q67YFzvhWWhJ5dv3kB0yLeLFh4pDbwjqURa12XhNFw_K403XQHQM14XX4wDwIOWuSdJjD_ICW8hji58ZbMCI5mLciDx0MxUzQuoA4ndi2Bq6nLZwD0ZsGwJ-RedYxmP0vXPWKqv1WazDm7oZptqfc-RD1qXKX5vDR8bc-jV5hNrj7Vs9yJ2iXYn5MQj58DhE3Dj8Yh7GZTVUPWqes7fvYM3GmSSKfi09BdlCS9KP69WT0jHAZ7jkdrC08tUGwqF_68uFQLlNjuLVdfYhqvWeC-TDK01AOjZASHIzHGYSdfXXgxWZyVvb2m4-Bz-ydR_peGAKmYK19r-TfvgmC_FRe8rLQEvkUNcDNQhUpusftBIvlo9nDpw3irKRDnfuDvBZ3TUIh6Rq965XA5NYLAikeeP4l1ble1M2YghrXHpMO1XxvvDyLRcB0Ho4FBF86cZ8-BG9pFRjRHDzdS1YtcS75CstviUjxxtO_Zmue5Jg2Xf0i4b5U5bGnL_9XYxfiVB8BlI0020YEoSGoP1CT7_3_wQzDXPpjVxTPUmotTjzV_X5BMP6H1HTjoHI873p6gkqt_QE-oXPEpRFbVhTUK8oVWqEwbjQy8Us-TOVgqKzPCxjepqekDNTxsOL6gclulQ2lS0UObesbKWtlpYwrqijzq4j39a1r3NpjS9QxbxkuQojaMyRqjIuuGI63Mhgz1NUEACrLxoO_8OuRmqPHazGLUviyxtU-F4TnQur5UtSPDXZQxiuOVNFMqCZ_YFhiiontvnYU-FEWFpzCXD-yZMm9tX81eU6bABRvZrfyl77tPjMiuEXLyeeaZdDDphGRC9YvnVxKTrpUgzGGGsG9HM7vGHukhyf2idrQaGusf5E5nXmoIu61va-VOzWJQes1Cm4xdayxRPMIJsR0VazQ2DxWE9k1Iqp4vL1nMQln-5aL4bzBxA40s7pdKrCmtv8UGAB7KXjLjx78D4rg4_IHncC9osmUvyZObfTqnzp4aFa1n5IGAXagiwrznK5w1Ak_RmgRiI0vjnEl4tRVTpDErOeMJ8EAeSptKDTgfr7lfXUlrSvOYChtNmFWdYailogrWdp5iK0V7YDSd5KE4Zb8mLX5NulqOquX0rLD5isF9WFpGueT6tEw6-AREQWnlEP-bl1dRdpf0X10uEi20mWViJ3CFOJOHImsQ9NRS826GvjoVWKbbASU-Cd9Q0UXAbeF3_HGNxfGsDfX2MAx3hlFyuZOEUKvcyuc2DqnrTEamdDpnpR-m0cFQVV8DErxPfbViRl21GFlm6Oy-IqaHGSi7ApHhIYkqJYGA7oJQo1GOI9QBXjQhxPl8YhomK3XTA6RfYABbO_pgxg_6BZf7NZlYxsCf-MQNyW4FpXLfBYTU2Wgcbwass9jnMKWyggYvcbyUYlsyHBwjcipqzJ3pc6pslyAY57gixA4swvKClUFbVmjBbwEQZva9aO2lBUtw2HFnO3-68b1hNQ-ug7zZHYuAUKMeLonHrTQmJrZJx39ORMiL0DcGmqumrMjcJOpzRvJeIvi_h7qh4L3Gvlupm069x68eNoqp29XikQyXQHmYVHZT9Rcr_-QU5C9ZD3TZxyMFKUk3dCtfvY_Dv_fHbKz-blDcdnKyaSrLD04wuyQR1ir1Q-wA9us8scqdujrAxaI2e3GXT026OrHb259N0B9cAA1zu0TZngv3ig_H1Re1w5CP8X5MGW9sp9Wq6rJdfH-lde_goEdn5q4FjsBB8DZ8TVajUN4nsxWNxKYP3bAJl0o9hjs0P4BRpQxQdHX2rA9-cz35XBNkFztJHlLkoJhjUJ5OX6BMEGxFYd7DiUVEsAZS8z167PxkwMicrjEk2IvTSYzl0GVJrIBwU6mZwMNOJ2cdyZ3Rx-iua2MZJaKVXFOl4H7eVFV108UIf9XJrifSRnoM1Tr0MunFM&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=1669276969057030100&adk=1033480531&idt=257&cac=0&dtd=25

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25316
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI0Njk2OQogIHNlcnZlcl9pcDogMTM5NzkzNjYwCiAgcHJvY2Vzc19pZDogNDA2MDMyMzA2Mgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 046F 0
857 B 166ms
51ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI0Njk2OQogIHNlcnZlcl9pcDogMTM5NzkzNjYwCiAgcHJvY2Vzc19pZDogNDA2MDMyMzA2Mgp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMTQ0MTE5NDMwNTE4MTU5MDMyCmRlYnVnX2tleTogMzQwMjUzNzgwMjkzNDYwMDU5MwppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTEtMjEiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjE3NDg0OQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA2OTY5CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0xda158e2d191c64a50000000000000000"},"debug_key":"3402537802934600593","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"1144119430518159032"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 5zyrr3xpcfb3 Show response
hal9000.redintelligence.net/zone/ Frame 046F 12 KB
4 KB 126ms
13ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/5zyrr3xpcfb3?subid=&gdpr=&gdpr_consent=&rnd=1700578847175187&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC9T6tH8ZcZdPYCprQ3gO2j73gCqblvaBpnZecp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QkIZhE2p7XLyiVKLbmGL8ydYRIitA2ZqUa2a8_cvmCE9Yw4V5Z0lLIZg091lx_TOYBa6rUEtKtNRkCXTUXtDDfBjnM8i4llldyhFQbp_q8EIohZzhvQok8tmW6UI8KW04locBL5r5T15mOxqZ-1tLNJgoaIlCcj3vSbirSN3B2jooLfAC3Gry5arDzu5yZaahBftT1_9NM4shAiubxyOMnB-36mih7zCAdDTGWL9schcbU8v14pbKw9FtahcNMXsr165qVXrXkOKDhGEdEPD9U-NiQSYXnb5o-3T6pWX8QEE04T6cMP_AsGTaLHa30ate6Dbbah4Fs5FKAgL9-bxfg3or94WroABv2AGtc0Vc9gnz4_NcwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCI2c4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_05ZeteFSShquxyRIki0PwrS3hvNA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AjzsKfxkAg4dUBEKH_mphaOc8qw19KYmLWSITAF4EFWszUDR8b2CW1CIbVBzy0-wtFBg2Qc5UoVI95yG-yeoXV5s3fZni_9PfXHjutY5UgZdG8_rmvdrfEJW6Lddw7J8OHBgrmabErSL0YmecJGqoBAGvhychU-zXqjscBVT3EmiLBJrs%26cry%3D1%26dbm_d%3DAKAmf-Cr58V-PzhMZIqX2ReI3zxL7Pl5poWQw0mmDOoiLywHVbzvBSX3J55oPH8yi9G3Q1SNleCbFi_IPOpvqJymp6BZ59rq4CevDppWjo6Lqs_qSm_qgRavrT5pCo2IWPtp0AFm0WoEvngbQx3wJhF9KodzMlcd5FxfxToljRzWFvpe9Zvbjk7sT53kTU1I43zhmPJslP9bit9eNtdeAUz_FWCiV3rl3puoImSG721KxpJT-v284r_bxlH0vIqju29mJqv4n6DFsJuv6zEittlB2S4LiQF2NGqme97A2UbPazvVVU0qFfadz9q2z8NkI6bXwcCp70G5YdCKGTpqexuJ9S_306T00rIdXlX_QIi68aUoSvQ_eOOm-fC0l3Jrv1fj8_tBgq1WUiKRdrrl95WSavMwsqSmMa8batE-UVT8ng4mGSGyVh7ghsUC4XtZVFfVfjltDLQmiDR3O4lmskygP16NCX4VkQfypXfKuIy0prXqbv81oY-52v_OrSX1_gFTKARIl2FjkT-BXeTDLHMuga5BebbWltCbZS5OJ7tqIszI_UPxg7s5GMjbkb3dqoi2UzJcIY1-MEQUGbF2_Pe_XS2c5ov_ag%26adurl%3D
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 6f2238b8c7f594740ebb2928243b4c80fe35d7762029d663d9093e19051000e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4263
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame DCC3 41 KB
14 KB 14ms
12ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AKAm-xEMMBb_kgLVUcSLM9OsczMKQxLSKOc3ZcEhC4tlCYM9R4SA7PGTolPShM5ES0ceJWt1KtXXu8sxOP2n9_-Kk5DY2waQykEzw6vWMcP6HpVZRSn1l6DsqGaErHBlSv7ZejFjkThnQYrZS1Gb8hmYzFwzXzirDtTFaxL6ZlCG4ypzQ&cry=1&dbm_d=AKAmf-CMBjS1W9QWusd7n6jcy0Fnsznx9JLvs8dxXYDDT1kqhhL5ZPtpOpixgybLn0vaF4pBRLCOtjxXUcupsiuC2f9XDG8VQIjPFm_EtxC_BoznsPPw0cEY03Y_5e_u4Bmr_ct_fjMeOKCIc12ZMwEFNzrNbYwTgdm4FCozErzioOkAl5maKFyDO--7zaVf0-zx1ikMlGvvhBDK3BT4jN62vYzoFiIFPT8mrOZVpogAKrzjSRntpVKyEXHVDw40A8VJIeG7WvZXOs8RU7Z5qVfDFDnzXYF2ucPzj_IKuDPG7Useepe0v_RraBI2fY7wsn8uRK0kD46WXe_XowB7yo_NnM6aNsFqX8zeAztRP4GWg18HUwvoMrk2ghkxinxO0yU93Niq-F0adtgUPWmfAQJ2jjztbW6oconWmRA5TFhW9YNjVXdbbO6wzQ_cj2uQzIU6Id8AEDGHMBOp50aV98xn-JMuEYroEy0p-OhAg8WYuxPvxVJiEggPXirWe_5e8IRg0gDVh9HEFXzAZ4iV0DTSWgnzHv2TuNWFVXAMFW1j68sMJO0X502OQR69-4i2SLya3gISGK8QyHSTLiake9HtyDvlB60CTcXZCCjEWp9ORt9ML3VNG7gYqAkuLuykowOV105kbnGp5_vBJFH4E3AT1ljD5L9zG_EbK633zz4RYxiI9nGmzIQscr6tRBjypmy_6T-1vVWnnZ1s4F9VY-Ch7JRcC84h2HXtcJwKXEx8I-fEu2dO3xfnU7FBisoIIUfgV7PVwSCQddmkWTunVs1H83XTpAhuRgioGS_XCjc1Cmx_TzQ2pUi39Jn3RVpMXC6tV9FPfnvj2Scy_dkI8LxCpfVpk2rB-IhbxH_SKIeTcv_6dW5Tf3mHGEsQppwvSRyfquwaP4AawWlKPtPq3ffNs8Bav-JeMwYa8F0rVqpnt2r1lolJuQZLrap9KeCggahFIeQ0ijCQVBDlWn_dfiTsohe8MLDX3g0eGWFe7Isw1pfjuN9Bl_8EFdhpObRjblslSfc_9txC8e66702CpwTEEEskjVyIXSCZlfKYfGwfgbBj3P-EMWNkCZ1DqO6Cr7JMX9TgkFmbVuzh4ymxKxNezVDJAjdb6r39m6YCZ6HdrVVYoqD8a2IQ24DavgcwgJieC5sgFKRCyyLErS7VwqIZsiiWOHfOlNjC0g3HhU6fN_zE7O0JOd-UBiv4xjjVixLeYnL_78It0Pl2NNXVw8AQYN7wTTV4L64po_mhorwtgXaDmCGfvqUi9IofsOJBeW1FuNXNP5YLcPqzHfzRezibbuQr650_ZbTsBQNMcd12LeNF3bOz77iqzSVuwf9TgJhp_srfntFCa-ENdYBL6ZDuMcfGyb1rxpWq-DoHCRlxndJJwlfeBj28od2a-W7cKvM-M1qhVvhVXP2TaL4bVG8KHErmaqE1ltvyIYvjo6IPRVikhJI9JiXT3rMxNqhd2aLo_QroxX9f-3fwPHdn4EYWJYzN8a-LIWizfLJIh4OdKehQzysaKHgRojbhhbcBGuBO4h1-axqHtmBEFe23xi444yjpoF-75eSI-cuRCeqr6IUa1134iuT1BPc-DXfCg1A9Sla4dKIzh1jxFO1N5yfVlwF5efz6RC4LNOcSR4BWtLDc_JgWghkittXKBjONU_wpqllP7QkNf1laRn7nFUbbnPdgK1LRzFytn5497tg7e79SErPj06RHRLnDbreqZX5IimyMTqnQe0TyFDmADYnOPwDGr9z-32bsn0mFCZXS_iusy6tLX7POVQh3f3lYHIkjiaVy6rU-m9BYDPm2mRinjevA-whxeCHMVG1izW4kKLk6K4GmRP31hRhBsCG-0t4vzNpzUD-tW1hk8p16EaWp_F5puLgRRL9P5WNj2H1WEGebvh4d9NTSZ3s4V2biknnR6c8qXnu1AV5NBLZze2mwfxWqB7zr-WtozK1LR56lrmt2A7-zHkI4zFRlYa3JND4jTXohVAMHSuUxw27ocd7s3Ha1rMPN8-YCzO3ilIPYAJy6MO0Wqe06-w1XOi7QvvvN8kR2954YJqzMuqQRj6gHT7v6FCDIednGrQKjRJukkxlf4JMDpq-_uoY86YoIWw6Eph1EAtmfFGaFuspSo57Q8GVmh2ueVBYskz11GI7U_uZAQJF360qXp1AaOs6ROqNgHQBkwE1I4_iRRBEeYJt7q46lpKfcM7tf6-hGkoxmoJhAVuxW8fHCytAMCCAjlvJt5eK3_bInksFoV86otFjXrdcd_RHqEe9XJf4NH2xbO2bJpZvjYTc9T0rvsqpmpi4lnFY4HUv-GcrqGPhItgWDNWZR0s5JcagL6vqFaiNfEx0gt488LsXOE4f7X-biMGZoHpNFSXk7NyIyATsbstb2x3J1xYeQZKuZniGrav5RP2jCrgOrKL2SyHHh63aXG1R8EOMTIrbMyEduhdEdvODQfpw_7GqFhB2TEXBdG-Xdfrp9QL7Ke0pj6wlCNcQWgamF8ywXRkyCaRmrcKNMd93nhynsjtWc8U1DcHcnMJgmq_4ByrMrh6Vr8Y8l6iJqti3W0C3W3J-9ZD8IGj28TpFCe3Yv4XZSKaGz-zVRER0WX8vQYgQcZaKC9XPOGQBVxJeXs1yLL87WXeXPoPJmKhe6yrmGqjUOgzBc_7zeObtwJIAJvsejnqFdujDGuwcavhDAjHhfog9NpLwdqTyYdO1OziPyJ-1DYHBmmYCEMVjBN1AztU3SQgiw3UNTfn0yNkR12Fyp2QnmIEk3L_ym7g4EASULbZx0n5COuIR-Cs0Q-KGTXrfJay2pPfEBhJeUy2Wm_6nUZBOsMKWHtE0FGisHuoLgpLCYJ4b3TC1gZtCAZVZVU2LZM9on7vV5R0tCXXkyd7tkjclsAcLMOF81VL67As4G7p-nuPxCFeOAgvFO-cYMIMRb-WKQNRiPtiA3fbNwCSKrNdnqUkiHJ5gs0lYzx169_iCpa3xTJwfSmfUubl8dI9J19UmWKYyLWCuHsi7s7pOvHrdrwRpaGxqtCs2dBKcCGyGhDGNCqxIcX0nInF6qecGavZfBOQtZFvDHaQm2Wx61N4dOUh-XpNW9lbY7Vjy6KaFjDUcQnn2KR5JPvTIpEBaa9lzoX_fKH08EXpvqR3uI3I1D79JcU0Gfp1rxFZZRjr60SPCQrKLSMFs-I7LDHFIJOxUaSr4AuhFTYEiB3L7FbuJ8mClimZbxzgU4_KU-IBHN1EGjO9FerFqkgKrues3TKdn8MQ3dYedISF27GCiG7uT2LWZwQHGPeqrJwiCWvVRa93ZswUWpSK6uR576LnZRMBthf0zZ3SO7Anmiyx9lrj_SVBpAxLqMqGPRQu0A403qPnHrBhWgjom6SZynR7egwiYyi0X1ASgDawslBpeKq5RNQuY4IWfJP8XLnU6py9U0bJgMvWDf96IxmwDH0ojwnzqRfk1ObWyb1d7Pdtvako5P6Ys2Ab2B57duS761KcuPr_UytThvJt43MWw8gd-RwlNoy_EZxR5lpd5YsJcFem-2oMI30LxKj7_elp6VbpA4f4uAKdpVly-ZNzPR568WTYapNX21pLzLHBTt56RhbiLNg_wWqVJz86Sf57f87_dTgqRHBHDpsTDCtZaeuJX4izfZ6B4-BVlB7rdkKBbOcMT8eegAhHL46aQGnSm3UBj2LAGc5WK9zNHfV0Aj3JvCmmdUdTtBBrLNOKkA3p4qWs8CIJW6AhU-L4tSA6TrCLnrtG5SS7P6VeUN3PwOr1LxfFi1TOieblEI2L4NIkc6UHvMadQG29PMBghDvrU7SVJOr5VxN-JRqLm1upV700mFuYhpvI_N95DGQU0vfbI6PZymdZBksBQJ1F0jd9ItbYKrfzApymaSBX1lajr9JpmvbQPlNtJ5rjo2y2H0nQvJHO9q6Zu9XrbZgZvttRtUbkamBdm468XPI1KRWcCfyuml-NSw79Dp79EcrJNXyGN1g7NK516qj88s1hF880HtZd3DhcwKJUVb3pupZqdh3k4-bGM&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=2944434094795118600&adk=2086295851&idt=278&cac=0&dtd=7

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25316
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI2NzQwNQogIHNlcnZlcl9pcDogMTM5Nzk2NjQzCiAgcHJvY2Vzc19pZDogODU1ODM5MjI2Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame DCC3 0
498 B 153ms
53ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI2NzQwNQogIHNlcnZlcl9pcDogMTM5Nzk2NjQzCiAgcHJvY2Vzc19pZDogODU1ODM5MjI2Cn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDE2NzI1MjI2MDI2NjA1OTU0Mjk5CmRlYnVnX2tleTogNDU0MjI2OTczMDcwMzQxMzMwNgppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTEtMjEiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjMzNDE1MQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjYwMTQyMDYzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA1NjY0CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0xaa00c7bb01fd732d0000000000000000"},"debug_key":"4542269730703413306","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"16725226026605954299"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK vjdy8w6hewcq Show response
hal9000.redintelligence.net/zone/ Frame DCC3 12 KB
4 KB 109ms
13ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/vjdy8w6hewcq?subid=&gdpr=&gdpr_consent=&rnd=1700578847175181&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4MLoH8ZcZc3YCprQ3gO2j73gCqblvaBplZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSUAk_QUkPDJc52dBdoQ4mVD6E6sV4qDJf1ivJvcIc-7nw-gk-EWa-VqLJj7Sryb1KcVFDwdI5qkYcjjQZ2AbHMg5y0UK3bVj--NnA4puN1pU6_q3-rsYIJ8ZbIM3Gu1nht63Spebuu3GE6sb7KHfp_eii0CcIs19m5ccfopei1uMDYtIJp9mO54JfNmx9jqHLPH1Vcy_Zhw_twacJ9UUAHJi6zae8UNwHqixGZIj9OhM-iRPUXJ7-o2PXYF2HK8X_1BvKO89W-illyGMRSs1CxRfmrDZla6jWvUlUrJAvKEPLfv0IhufJRD6a46H7JHgRK55awTLBbp0P5zd1tQ1s7wqJuGA9VzS_xHU8DvL5nKT0yRD0DlMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiJnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2nY99TnNIPnKAuuVrjl7UWnuLE4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BFgxdEPMjEh5FGasfFRYBLMuPAKz1XYJ6l9HMunyypBtnyoUn2nZQ3sej2z2xVKGfRbQefhyL6tmoUBARmWqpAYPY0e53xC7K_aYVBT-R8Dk0VDzcVfzw2KyfHaabi72x-l2WY4iZ8XyNl8do1NHje1XN4yPb-_eZlA_i_ax_Ln7QUHZ8%26cry%3D1%26dbm_d%3DAKAmf-DPrigxJGOWiVqdTU7Vsxsl_aYK8-yxXqB_aqxl02R39s_uq5fcFkzFafh1PnftBLA6qP4s6nGDcm5VXvCipflWe6eCWN_7cwjwa8OM2QjwqLPYpgPUhaZSiATMA9ZR8i1zyViZiEw_sHY6tLsYLvxiqi8N11umd33w48vpqxlIOhVcl09odct7ZRpOMWzJscnhxeeyi3yrwo7wt1u5JW_D1vzhc14QwPu2945y3qtcUIiDiq7svOvG1PChRVsfsFug_IaAlV9tm6hX3VdlKQCG-eYt_nLT7s7SOAGJyD6Y0fkopgupK6rT_1Aml1tgSnEC6H_SfDPq3n4tyivtjMhZaCNY6TnfnSvPzNsTDmE_t1DlAKzhHlPXz6Ja4E7dvfwrQz3x8sIxSl8kqJkcjaFt4T2jB-XCDRxVDgD_yCRG6y9TQtgnUEUKCp4GA-6Y3NnrQKVqm5P2RXXLlbMGvySsMWDRvBl1rXgtw_xr4V2g8yGwHOIwGcECnCdoKMTWuHnP9mVQVgc73U8qbU_VJEZ7h-NaHfyshXdmLAd6DKCOIrNS8mrHeabT0XDhbfkJUMVLdOIrzyPokXTA_vwSGQWOQ4fckg%26adurl%3D
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5ed9746c036d3f9c91497111e7578f56062ad4bfcfb790e149c9146ab139c867

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4261
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame EDFF 41 KB
14 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AZ8l27WFwOYkhWytXBzm_82b5yNQdBfvN9wnPvkJdqXiCupuEFxdPGnRSjotGm4xSAqBfhdy6PyDfkfRdxDMyBIXnTdTte5r_N-iRPbKtlaIVuBzqtDjVkZHqMtONGT8zC70kmFsRg3o-a3lmM5g8owRGNdhMJaCDX6ks1JFzM2mGA9PI&cry=1&dbm_d=AKAmf-AnE_IwNfmmi_Tx8x8sVDMXMGVqVE637z9OZEE0sG04utAiBJGyODNF-v9S8c9dcN1oI_WQHXFCEQUZ0OGosYyao-rFO9vOFYdOA25b9VPzW7LeVhzKiGAX1lbQRV6OByz3bxiZcX9Ux7ic7ejmIkoCKmcrBjYqLGVfklcbvBNjOGJjAeWeqU5NVBFxjc3Z0wuBNz4dkIFxLqy3W_TdLsuCXwaqK-iMpcuLeDA5lRrb2ElJ_psChgzqSXi87EYKG7YGZKifdW1c35s91_rZiPaDo5bdsiw5TrvuZcwpuM1d8mIm2oks_d8gTXIhIm_VYkhIQ-t1bereQqN1fMgcgm74gZgjaHU3xiNy5knOfDjHabgbCiZWiIJi0LfQ1vEgPDpHqAQhkjruKymq0MQcrjycRxlmXI8MhzcKX1BXYcOSeJZz_mbUek7DMsSJCmUbAM6Ze-knIp_pDlr3mN-Erp_jcXO-SB6fH4B6OoYRuaKySKe0PeSy3HmuxtAJvZtNQ5DXkXSqjDBEZ-Gz7MfWmXoS4FSAtBAOOCtAotLKu-vGd_Qlu7E1cXTJPFlBxjN7J9hz9-RNbo8NBLgBuy1D4luRoeuKEj4HAnFUNs0gKp5EQXME3h5BVUnNfVMe3uEtpCO_q_iSmcpB-6H92xiGZOseSXBpgnsa72O_-j8aPUsJ953ri-0fJ47Qg2qTioNFAbBCfNLiUJy_mJni3w16znn2xR9zRGxbj1Ph2frNNbku1zJxm-lN8-SBJmeT5lMwraHTWuEEBTlL8QmCeM0RbbF7Lqmbpp-1Wjd34_xThhJoM13lXNpNkQOA8Gu91QGtUXpwWwi4BDh1cRwvlgIt6sYF7lChReBOeawibOR3juJ4qk2GoVPxgVgjruBRIMgBzFD2ioliDauWogqT6c2sOLO_HOvmV52Qk21QlyhVxiHF0G3wk_f0cNXg11dNcULYNieAtI2tbZRihidBMFaWN8idExHaRRj6nbBKaIKKPqytEvx5QBrDNLGwqVpG-0ZWxuuE1CGVpbsFV7Z06EbyHHUz_UZj4HunuFK1bh6GxSUbDZZtMzqjCoBaxTd0FWQMWloAYFLCJoKP8iMVvrqEpUtvs1tKhmnj2KYbgAfeAHRkliZXUjkx1ftOMmeIUF0mev2k5bGsUZQV9AV_csuR7VgbcsNf180qO2Cpsa_sMKiXlDs9FqiniZpHlXFYWhzgQJ1AUgk8mHxC0nFXWnlewCm713_5UK7j37335MwpKMdirWDHvMgUqRLaCcu88lUQhDcODe4Nr8dLB7oEkd7T-9JU0KdQUgu-tzk2vwLP34vqFoJ2BqwhbYtGNgz3RnXoyV_gUoQY7TBW4dIFWCn2IPyKoeOa1_nGC5Ai6_pYeVKstuFNbbjJ-E1iFd6ThJuS0IBqk2Q3ZwIcALM2gyDHKNX8xi5htcxrOgU_C37Fcao4fkCT0hYgRpH_6mNnH9p77FjIkbReaGKHgrEorxVVd3oKv1HCugHYr8KFi85J-DkvKqiNiBc8O49mYTqxhesvJ_GX8_h5VGWzORB0g7ht8noy_jqgBelf8R2HN-P_Pz1gkY3esyVKhcwSwFdhO7XeGRsTEwiaL_-2cx7xlWkKuCFMZ8AvlS3a-rOHz_LWx8o2U29HYMrao-8RyKa83nBpEFi1zl3jIRiePYEDkUNaQ7rMXCfG18b697TpyUy6aW2FuxgpFmN3mTsIBIifkTT8wSoqRreVITECfqnNpXy7uDEptqKOqsrnD-Di1PAbxQpVtxl5R_NPLs5O9Us85o7D13AieCTwc6MpnrvVzA8dDcE9REcO93UOrXf5-Ccpa42mjLfmYZ8bF4719BJhpq-Vldiew_bcdE2wk84EDJ6NzjlNWZdXtylp0X6QPUljgbhzjY3E0ByHKBL5deUnYN5gl0TvTQqzYhi_pCEaMgkIyzQasBHl4n9r_WGrRkPIJFIBVGiAbjmVtAViTtjfeC8lvQSxMps2LpF77ONMQo8nE5R-Bk1k4mgtccAopr9UGRo0InxD9aMDTYuKk3OD349I7L9XXdFq83-xOmo8gYCgHblMxySOIPFG0C9ncwW9bUYHK4snRikU7Ixw1iqfz6FZ02lWAh3XeM7GbnDOYOPdrK37xBJ1XI4GKrwo8HQ0RMhrn29T-0umYYyyyQ3OtNNtvpjtmBfLr7zeEuBKixu1SUPTDN8nc_P0UMu4xjRVZH9V0E-INFVOE14YBa62rq944ZKXCDTsp5jVrY3lAEBHvp5HX6Uu-ZYjA0P3GCK7yOjKI0XNmuCaLAAw7l3Z21vLqYUv7RwnJVSgful97rfIHedf5CDDGFSxPSMM7-VeAg6HhmHraZTF6JofTTItYo_0Nj6Gvu2zShrYHX6vUSwxspLstuN6htdFmoAcYQqV4vga67pB2X_0vFnx5a08C07K-b_5Ra81SyEfWAIHy9F8HYNNSVUbngSME7o1l0Vvs-2wTmMngo1EC6f4DX42mr3KhQWSUeAjWJnT8Ee6kzZSM5Q877Blnhb811YoghPLbAF3LOauQYzxBqCvBz9lpSpSG1VKmlrdhjrKs5GyFrnnSOJdQMA1nPmPeQWBifbh3uBwhU5dQ_y18aTsT-i4J0Lo5EOT3GH92-x8jNNY2cUn7CM77zctGC_wtxCC0NDQPhOpICVxLo2uJS8RsLOs1bIhJkTy2NYAjICknxFOJFKxlPyZBDaPp2v0PAIpJgWF9G4ryMonClqoAmWfku0GHG9edEaC-O0uZM8Xf8HraMBrrdRRhG2f_axZbwgi6WGdb9EJ6xLP2ls-DC9D66Xy1jAtV-DZ2y8sDCxGQaXj1KK9Gb4UolEQC6KujciHXeMhi6IAxUdazzxDcbqL91hrLS7hosk0GseW9JnAf-4w86Eeu-KBj1FgRfkfiyJPh6akFeLTCewYxJC3da_tq92hy53S-F2nm0nr6DGRj157ru7hr4WoBQm664bnU-wd29sK9P2eohX5BUyi8LHt_l748zkdxzWzHKatLLDcLVMkvqGr2o2T3dVSFi2ahpENlfZjO7iRF3XARbN2CDRoK9izrnI0YwVIQUeR5e4zhI0ezlYMcfayZ4echXGLvOcwubwxd2ZHomMIbu7RkuFhoPbvo6WP2r9JrTz0UQZrSd6HhaU7Ib0lDUDk_CJwaH2WlWp8u8l6lS1huY4q7GL-y0rKIfVzxelf_94lhJvJCezAt880JITbDQfGFhWcvkV4_4IBDp-G7OXx0q-4HIoQ2oOluDI7RQDO-zsvMTw3A7tgsEHpE0dVTYvRd0mNLpdFUVReSWgluSe-y_eiNxYFurzayqN6vxzfRS4BycexcLyEz3zR5eXQsPk6ReXUuaYiz40d8CUGwlBi5hJfeoWLi5NLvwQy8QGJO9m_Yp7BtDhuq4Pl83ik_wGFje_JqpokHCFeYieJLb-kn7nYDzsWAlN73eH-SCmnuRk2_OWPJ5Dms0lC_4fDgbAE2cvuPPzN4tJQu1oceSIyD-5Gk1heTeOzXgl_3skJBiac3vQj0L0ICFTq0-MnpjxPe-AO6KJbbSfGEgis4DZ3xhopCRYvTMRUi8zz6CVFVvhbOS0cxwxdHqVemNOHMzd-BAW1Ag-l1K7X9aofeBQ8e7am5FRFrL7pcfEcRVHpDuMdwRpJOZuB9PRRMbGsyHWL51UdNWJ3SX6mDJFSPqLrpESDtg_OMkBUFAyn0mTSHLKYKwnSgyeCJ2OdxGWDwOj_eI_fLgMSGGwkdMfmmf7s19zpDzXz5wIwrDYiBUlP7B-e0NzHwDEAi6biIjWhugBGPgjxKAbDQ8sLVQEgSnIZE9IBcbwsXZaZzsWGpq4JMza1dgGZxpxBpSivgjg4WlkBBLOmk0EWP5ul48Om2WVgSjAEdv23wtfrGcMVLzcaTf8BNFavC0zUb6Mh3xwVbzpxMj1ZG1NEJdM5i-37dPVh8kr8l-0lqvlZOj9YgltBCM68H70VRFYLJY4dLjYOVKMw-6EGlgIlIsVmthba10nvlYI&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=8024944143517269000&adk=943508955&idt=275&cac=0&dtd=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25316
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI3NTQwNgogIHNlcnZlcl9pcDogMTc1NjE4OTQ4CiAgcHJvY2Vzc19pZDogMzAzNzQ0NzMyNAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame EDFF 0
497 B 156ms
61ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI3NTQwNgogIHNlcnZlcl9pcDogMTc1NjE4OTQ4CiAgcHJvY2Vzc19pZDogMzAzNzQ0NzMyNAp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiA2ODQ0NTA4MTIzNjUxMDUzMTg0CmRlYnVnX2tleTogMTA2Mjg1OTYxNDMyNDUzMDIwMTUKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTIxIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIyNTk3NDEKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIxMjMyMAogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0x5f0c1d01f29745670000000000000000"},"debug_key":"10628596143245302015","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"6844508123651053184"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9006 41 KB
14 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DTeYc7uRZti_DcsqJqG1d0SaNLlMmnkry7PuqZzDcerhoJnOw6Y590KmfmHfgmG86PFFoKF8VGCfN4Qjcb0hcs2iQkmh5aga3CFsxIlqi8v688JUrxdTZBh0-gMQbBjszPd0hpMDShX7seCgeQdBC-1-pC6QtKhU-L7uOAGv7zkK_ZDRU&cry=1&dbm_d=AKAmf-BeAJkb2CfSiWK9tZJfRkUCyKptze7fqUnGPd1rmp3Ld0Leo-XkT21F3SZ_dgyr62NHVz5nMjdEAu1XUErmMhTUm7k8mOQTywsxqoEBAK7pJ1ctzoy_g2dDYNpg-dNLzw5iup3OqLQVyeWPndmRI9oP5PksN72U6zgBZgoVHRpESr6sJMFfMODs0zKqq7Ygj4VmgrTTgPivcurvoEWqJgtfqLPXa7Y6CnVWmAbIe4WGS-ICI--ykkq07P_GOH720DeD7aSxbC6dSGFfjRHluu398qx7yO4XUnxJ8_Yt-nqO8oDGBqvdzW9Sf4aHTxr9LOasHGQvVrxkwlFUsFMylvYIA9JsHSp6d10FNATpG-zJt7pMWSPKmRaYWBpesCn3A7HK458uWQOJ52mYg_yojMTkcvFYdG7ATlbNknd3TG8upso6qe9lKwKrJNmVQwVsJbE5QiqM3RPw9UIjH1jFSftygiTKd5Ffjr5eW236DkIw4rV3iQEmoOV7OQSzRi2-aFhxr0ExUJLrRvHMPZByuiIa6Inzk9_NbU3Jk4bbi4tGyUV6vLqtdpEqJIE0bzbtkBi2fL3sukk6H6vAHP7teJRoGIF2Nqpi-NIBqGcwLyy3Hmaq-cTM4cxH_LrZ_7UTJ88Cn_zY49OiP78rzjTyeYstl6XxLZLKziFQZsDLtskNrfRVIl0Vz0UyaB6y_zbjCJMzo0mBR_oBY9jKJmmxhmFl1938YaAGZKdEKyxI5Ag_qcwlQTo4bU2mcEiX3p2Gt8NcfY2vsqTADd71IGsJiIHFNVQDq8eTXJ9OE_cAHparM9iQ18VZOHj2b0fKW8HAQioF4p6ceAP1sRg9q9SLm7JMZaAoh99tkT8WGgOxR0sOTrDxDNV0R_2Lrtf-Upj_8_0xLJ_BcLbuYBRFdaGPSbj63x2DZkqmt8dsYo86sLh5r-IILnXw6oDfx092cPsyfWQVVhRDkobH3KBOWnIxlLECGV21AfYsRZC_mowsL-rCQ4JwIi-W_pmWxX2568pizlQZzNJdWjznWDaNvg7RzGTE8P0NhAHIAaB_7oJZ_zbwTGnX2I9pFqkRLwQFVAZdQmGeODS_oHSlPj0IxeFN6Z5yQ2f6Sx3PEzxOj7C4NFfShHv4if9068aNDggY0LhLjEzpkYdW3ExYN6VyGJkl_bvvmQDz2OuZDQKncjFDKZL7EKuzEFX30HJ4zYcT6Lljip9PGj6ajgwMxXXh1Oqpiebi-ZewOFG5GeGZUclknZQWx6Uo7LB2w1usH6h2uwV91wBKZRPI8-PoNvoCPw9-MkAI8bBMKqDSZsM3GIYk6AwKSP_l4IgBywLsIU0mnSbGgxj3oyuIeFB_cVdMftQFAWArG5hTLr2yYOWO6eQF-v9u6ZEvdh17ffe7W2izOpfY2qZ1LIgSdo-ypqyQMaP6DtgSQF-5plr4X0qQevV3L3IDf7S1AyNYUKFXms3D-jY7MirneQmSubImQqI3cgx5a4D5myPYLhoLxSDuaEpRgHUVxuP-WJIpWWA3vGrl27SPQtqJHZIywtPVFgP92yIXi6koXG1Hmy7Pf3vp_7yCAVFMX31SEE_6BpsTw_wp-ne0G1AjhzgY5o4-97f0PiXu8ziH7DC_fEWKhN0MwLlAGrnRJRCQUO_h_oZZvpUBYYtM6rSj5sTTmvQ3nrRxboi08XD8_QFPULzS3mtYzWNm4RpGTRM8loUo_0Q_B2ikXlGXv64mt_uxDR3k4mQgymC_DkGMBSMGu2sByabEB1SngJm4w7jf3B8euxNYJOf5s5JdgWaAszArognzFtW0sXk12iuV5nm_JktP7GJYABfQCNg0iR3TttKs_fQdujTucrpT4yM4mgvbL021VtaGBrzxIJsVnKfDG0LPzbjn_a9B7MfhhRU7euL9dtdF2mcN2jsiXt3Swxiws1VG4ywmwADRIafS2ZR3XUn2qKhyR2RTgAcgjc7H4mZUsSm4FpI1TxiPGuSSK3ebN7zBr9lRhgv-pXuCz8KG37-ulHU08p-Achrvz5eV-P-ChOMRF_qHB5s6Dh24rons6ZYDBuDUJMUhctWaQXrBs4uKT473faQ1mtuPMjN7qX4QFmgqi7syxzCKxCtXpdaUuQw34nkrY36PB_WRYqMXnCGY70scsPkwFIrwCGnK4f81G_ydvX8PFqLzE7SVBZanKWr8yPdiPqlieoxozT7o5BTuFfr8GZsRNM-ay-aX1NEK9PXF1mCkl8MBWQ4wskJiQWQSM6TtXypmBlYQe8wEUUf0j_PTt9l4bezjfA_-S96FPXWJxnnD_vndKuLMVgv3iigmY6xRexB3btw0wr1IrU3FhGyWkQg8abxdSrFFd8KiD3j41ESaYrtbR6bo4hHULEkpzeng2MZO3mgZO9K76XdGjjQvIKPjBtOw21HtExhkEck0Y4Ix0FXbfgtz02Ch4rzAo31caOa9RZx3TAL717hyW9DW73at838cjnbFdDpS2lUqe5zpsLVnrT8i2l5RW2w9KJwxSr9Rg64uisBWu0oDpnVQ_5fQrW-KzjKocJJwwsLGstZ_rvZejjdbMLp0E-RSxlWfjgZreW3ltwLYC_ALUX7TmXRGzz7-HcflSiqiUkof3xkOol6nV5lH3lJ2PD_YZdSozrPWWRNZMVzJ7fxBmBBiVg54ztpJs3-EzUtk40sfQdS3Bdx4-QRW7fvVH3eKpot_covsn9lpMh92SvZvWpjZFcDUNMMSXtdWdZFaLj7vouGQNWT1ha31DETqLGonZ_ljARSbIY2a3P5oyGK2VuP8iL74VyHuMGVlyDLLHF-PM7-5UrcrAtPZH_1zSdt5p7ddu_6SsPlcqZ_H-Lnsjc1ijAG97CiqGC6AWqJCgomatk9JqMbhRUh7JYkBOX14OQ1ui43nXAIJ8XPM004iJ4H6_BtiFKodsXOs7m4CGkTo2icDMcRy6hrtqrDNObRRVcjfRDrIzwLNgz8t16MUsoDNM39PlB-tQ7V6dv3K8IKIPlbzsjqiEYRsJ0ntE_2FsKGFJRzldGgoNWR2Cw3Zf5n2w2AE8wsyHsqqkkoeb0uULAjF-G1HxmQpL9CBFW9Tu0lEPebg5Q5o_FCVn9GkmbqtT5IliK4weaqw0sqzll9lfKWMNVXr-_5H1UFFIWxoc_qTAFjf00VJRPJ3gP5uazLTal5oS1uzoUDx8RtQt7cxZc9GJ4vQ8Y2L6luR1Va-25NVUxeE5YpjwOkSPyfXxZDfYzlxBGG2BzvT4C5w2cP_liVN07nhoyLVmg5ZMycPsly64S1VIwzodts0uNqt07S_3idNq6TFbdyvuRx6DD5ichoegCylKUDxmfQiJnUVlJIW-F3g5Hfuevla7YzQhFpr8LWQOBM9fVDYn32IMJWQBFPSddfrG3K-LdchiPWecSKGfgy__ToQ9OvuBhfH1KA5MnQz90iZeIc78NGURfsabEJaOEhLuPajLtRzM9PaAdP-lYFZfV5oVP2IGZ4NsyE3YTeKRbNUBVguhr9soZC9kU8rBbknHjzWEkYMb43LxCmkKIFzlpTzihdQE7E121KJz9ZBB0WDB0OCOISKkBWGI5TuiKCkpg1uhw4bFCpNpFhhEeL0Q9CyWTL95enp3VeECs75s41uYGOoL6jW_KS0KXWQcdPE6Nht8RZxA9s7glNAZyhHVnzrB-63wf4xMrOfcHSmLi7Ro4OFAw5qjIWinRcQB4bUONrmlOBQ-Hq5yl3dPC6sALeYm66bQK9vHHCdU2XKMyQIYmUTXUDTAPJ-5d9TNPrrIRMwY-J5k4B88040rd98a9AtLAPEaQdp3o_j_irdiFkYsyDvaJyEsB6T1DuJmphTwEhSEsvAYXlLjuMyY48ppHAS2OHvJIMEvUHy7DVhmstmKvxoJkO01DVdPgjSuEqrbd-yCokXrNIFW-M8k5-qdP2MpwFstNyh_IZ47NKC3pOUqPnpwLajEBBsMRCD5owsx4t6UOPl-vtIrpoR0G9WyHdrNVWE3KVNRhFZmkdkN--igB3wxLw&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=8479604203345502000&adk=3690638929&idt=262&cac=0&dtd=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25316
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI1MjIxOQogIHNlcnZlcl9pcDogMTM5Nzg5NzcwCiAgcHJvY2Vzc19pZDogNjcyMDM0NjMyCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame 9006 0
497 B 161ms
68ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI1MjIxOQogIHNlcnZlcl9pcDogMTM5Nzg5NzcwCiAgcHJvY2Vzc19pZDogNjcyMDM0NjMyCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDEwMTI3MTM3Mzg0ODQ0MjE0NwpkZWJ1Z19rZXk6IDEzMjg4NjA2NTQ5Nzk0MjM3NzIzCmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BST0RVQ1RfVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX0RBVEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiMjAyMy0xMS0yMSIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRkxPT0RMSUdIVF9DT05GSUdfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDExODY4OTQzCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0NPUkVfUExBVEZPUk1fU0VSVklDRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFURk9STV9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1FVRVJZX0NPVU5UUlkKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgc3RyaW5nX3ZhbHVlOiAiVVMiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQUNFTUVOVF9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMzMyMTc0ODQwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19BRFZFUlRJU0VSX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA4NzgyNDM2OTYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0xJTkVfSVRFTV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTY2NjAxNDIwNjMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0NSRUFUSVZFX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiA0MTYyMDg2MzgKICB9Cn0KYXJjaGV0eXBlX2lkOiAxMgphcmNoZXR5cGVfaWQ6IDEzCmFyY2hldHlwZV9pZDogMTQKYXJjaGV0eXBlX2lkOiAxNQphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2FkLXNydi5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9rbGljay13ZWx0LmRlIgppbXByZXNzaW9uX2V2ZW50X3JlcG9ydGluZ193aW5kb3dfZGF5czogNApicm93c2VyX2F0dHJpYnV0aW9uX2FwaV9yZXF1ZXN0X3Byb2Nlc3NpbmdfYml0czogNzM4MTk3NTA0Cg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0x12d474bacf6c64820000000000000000"},"debug_key":"13288606549794237723","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"101271373848442147"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame EDFF 12 KB
4 KB 109ms
16ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1700578847175184&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCq79wH8ZcZdDYCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Qd30L4V_gfEBH8JcKzCYu6_bBK560CxhfNMXPm23ICfWULO9ZOHnFjxtU-9VkNMZKI23xx5aMaywmwyYv3vcBYfg8XOAGJiHKF_G0XfMHJOwC03-gV7yA7CzZBOVykZ13RyvL5KqnVaa5P-Z-S0BJ7srzq1SRTFRQW_xpAUV2iWK7xiej76CME4MANZBTq5HBJwks_gzAh-tL1rb6x0hI8pVgxEwK9uZepT203bQoHS6OeEXuM5uNh5OFd9d2Sq82Cj0UoTdKNjHLYX1GDC4Jv_cJ5nX4POfjt68TIcpzRsqBmPwJqF_CLLlDwP7x9Qy1R5lGKIbXmsaVIo6QHRNDRt_ZzLGSu2cTVGr-5hNByMf1JNGTpcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiLnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2M1fFiC7nZPQ5F5-xxbS54p2_tHw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CbfxJpiSVuWA87M6T7cFemqiB2tTMWvruH3ruPOhoqQL3m0QwcvfUJJKHIUt73oSbqxzMqHmM9iIn588soxT15zkH57PfKiY-aKMOynvfYj0mEXL7rOzPa1fG7vWN69yIBpvgpKz0UcjBxpg-eVOATd_TXoUUvg6uV7cHreFrTHl2_yLM%26cry%3D1%26dbm_d%3DAKAmf-A674eyB_TSWrjiN6pr-uoz7kQ41TrO824eS6ZYP0G1N8pbAsRVW6oDHMs5_MjFLtyd5ign2Uap_VwKZZEovzhpC3UJbYPvNTGyWA3TeGP-sWoXMLYAqyEJQT7KfbgzQZJ6XMVaTmtHRt-aXrzm4bu8ZX1qmQn9yTivTIxB4QjnZjvMzAP8m3fzYORb2-3oivor4Cw1i5eygJeCIrVlJGanBDuqUHzYw3uk0TGhkri_O_Ht9tU900Cznd5CereS7AZXbGy0S72g0H7mGZqF0p2AuIgMZduQe8hKid1aTDs9yzyK9h0KVplJmId_rCWManJtGxFVsv3gmjvJJcfCo-zzJkaDK1u17c3wwOleax3AQKqEAr6f0x1IM4JuffK-BPk86bmWt2QGaSi7JDTFjPvd3Z8WnZIkz2_kAwG3CXCJaW8cj3hr6C7cVjDUD68rFVTuu3d0OzU5xL3BA4NaEWovryCIA6Lf63H5Gf7qBlfJZ5gOaUg5fpl7wmb9-yRGlFZaBsLa5rkCsbr-1S834C7aD0mzaI29EUu8CPhHaYOXS1uyT07v7c0-byB3p9yG1lSyDU4BRbblzPu-2e71LDgL49CNpw%26adurl%3D
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1b8f0a9634f81810e1d8f5addd26dd75d8681e61967f6972753056b0f54c01d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4269
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK g72h7lz2c4az Show response
hal9000.redintelligence.net/zone/ Frame 9006 12 KB
4 KB 109ms
17ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/g72h7lz2c4az?subid=&gdpr=&gdpr_consent=&rnd=1700578847175186&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCaOyjH8ZcZdLYCprQ3gO2j73gCqblvaBphZWcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QmD0mzfe7qdTmJTKYjAcr7R_rToZZ3noEWX-5X4U1j43CmZvOQbZKm-Lj4DgDc5z7dQLrvITqEuJ0Hf1m8vDyM6KsAHm9Nu3EL9QBjJDcLry1VQrY__g8p8DO5S6WmjIindMzqL2h_xBC_3Dzr6mIBSz_bI3uTMdMqtQ73jmcy99aO-p9l6qVnpIhwYj-qnJeNeeRUuIkfoBp1NhAn40cuUyb4soTisjDGCByRC9Z8lnuVLpib7AyeXwjsVF1HeTQeXo5v2Ct00jyxIU4YRLfsJS1Pf_VojHby5jRC57F8mCNmEN6H_PYWO7ROTc58mtaaAc2MnsHdUVgDYoOqAla5E52NCzhFcf0vGTyVR0liTuv7V9NwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCIyc4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_1YLCQaZ6QBEJu4GifY-K8zNCOiBw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A96P2zbYRbcY-D9FoSkhf2YiCy85ydHDuHOHTRMVyeA9uI8o3noo8rVWW67-lVvcZiyamIKl8h5R4QoUqXv7blDCwmp5ASFdQiNRdpziI_ceBGEQVg3GMlFzWk3TalMqS8sQa6ZLfiiU2fF0AhQQUI6Ci18TbUjpvVMyY7eVnvoG3E71k%26cry%3D1%26dbm_d%3DAKAmf-Aq0hzcrN7y9axg2fLa1uM1Fl1RhdqxsyHwFbkMBOrqeAA-3JxaWe3igzYfbRRjtBqYUMXheOzoUiG1qhfG5YjKlNjtBL1PnU7_SxlHJdw0YkesYW8rXLVPdnRK6__JwLq1yGOduICbOXo095WDthsvyXogYf5HqKZ7V2Ysg_dwxOvnkJ9eoueYzO6aa4KJT9c0IMt2e8cYHxD_mfTMDs3L8MJDrCJNNdO3CSUQktB1GTYgkQG5r_Fr9grKXv5eZi6JqjhSrlG8qAgvadmqdwFk8ZMcj_RoY8vtP1643dsSa7NDoM9e9YcAVAmMlRI84mpCfYXkIA4dsUlOnY0f1i0BVxK8kV1vweCVftIHYs9Ggs_ONGkPrGr_-1Zqlt8gnXM65zHPejIXSJ4RJ4OFyZZRwSR0XAlOuScrTkLER1wFl-72jFdAbgwUxhD2pPWIUQqTq8LgLBbQJVAoE_sBK4UOv8UxvHvzeX7vcw9SIN-0XCvK2BORFwIpWNQ3115Qplz74YdFR8dJlJZGJRwgdtLj1ZWEBe_j6iRy3tawx4NjrSIa9VbhdwRCXzpgbSKCybNmQoaAYsBZVOZkrliXRyl8dnwK_Q%26adurl%3D
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c3b37191c8f8c853ebfd6920b09eed04359f86ae81e586ba2be9982cbf735c4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4261
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 5142 41 KB
14 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bd-MeHAalwLruznTj1ACLt2Qh5OLbayss5rIXNZaxVJbBFKm7lljySu05W-4RyhuXoYVdrt2sC8RlunaJZVw43V4YAwGi7GOwurA5W5nUWO3uY6SomZDcYzr_R7J4V5jhDz9fV71fWn0v4UQyOyXFO9ipkxNKwcbP6g5dv3ge1Dh3Ryqc&cry=1&dbm_d=AKAmf-AAwbbS4fVn1MuJJk8y9mSHk7r98ouY63EupejjY08oYJoa8iILEbeC4PRcst4AE--GcMglEssu6tYBFaBju4QRdMVyFsBP6XwB1AIuWJ12w0yRf8FtO48IrOcIVqRmuEqFprJQCe_cW2fkJ-GBQIFWB5FJwSi2fy_voA8fsWfg2Ob8YW6zDC8gOLNW2wvpeKp_3llUS4EeM3cFwuieLLz1YWzOnEOjv-14J9RaTSFW79yqT7FcxzhiCy1rvmEmZMFACFRNGIyOGdr-DdsgMcBO5rv4rEqnBepOnV0KICCpmhHbWZJ27LN4u6xXBN71-wybHVnAEQIloEYVlr9ykfp8bfB8RS9imWGLbPaekwPqWIFlu--No-QXugX3gBOuXw03DtMuSi9maOv2XSv_zm6-yrtMFjXfSFGM7qTkXGAVo9x8HqLOaWJkWem73Wgc6dcD_KYGOrpJMLYouu0kfHFZSWzngG3anlC1ALLm-y6nK0OxAi66j7-k14b7vSWUlY4DkhWVc4dyZCPuvp6HO_Bs_t0y7ie78QajdqU4ipMHrpz8-TaZdLrmvx69X8P9FGe-CsWAM7BIyItPdUkCVb39znIwV6FYRjaJQsWihK3_KjDZ7iPnxYqx3kRkYMFw3O9uCiDGeQZq101s6MtIP2pThTpZJQhURpbAx0Us0Zo5Ph97bj5A8VIWJUufEHmyYM32Mg7r9jUgdDSoV7llf-kcwlTA-R_hzYRLax37HhEcVzQkC69Bqrv0ZtkV3-tQYFDrpgPin81FVHs0_3nGBlNzvQu0CJeeZ8Rxwg4rYfNknRL18ekKl8Fq0MBZqmcvAKmFK4hmkHT3VPad5vUOZfh5s37B7VrwslAAK_G_J3GHuI2Y_-M84nRD0JJW-_CvZ82qSQgDTz95Zk3fgm_eHNiD0_RpfGqT6MuEV-QZpQ30dHF8lSn36p-2Mrg92RY_ReO-Ttu9oUAKDBz5r9xTiTHFLJL8p-gf4PYeCIWoMSAjUZzLlT5WUo1RGnch9vRD6cQ1d81Hn9m7YbO84iqBtkhAWr3_hJVYIVAJVhdGhK6YBHsHGdqjRHXkVsxXUxwyJ-ozQVtTI6yr7dc36IUNJRVnL6d6k4ikZeAYRDTt57T_FOcA6gH3CeImP3eWf3keI7wRvAeioNuvRVCkOQ3ibqt0g46cMFco53llycRMEiv1--Od049lbKqwfzH4PqXnDDXY1k2hyNWvrcgx58qQh6f6SR-bAzWwLIInF8YrtNOintgaY_q10GSIgjWAvIO5deofppIdM54MWyyGK5cNxXVBHGwbJLfOHuLdwoOgHCYovzyEscmVq2XCmiwQ597fbDCIIpwCQwFE0pyVZoW5KtVx-rHyC9S02ippF5_nSVVNeBIg66NXN_tjpRDQPPiK1uWJ_h_vWRlQ_Cpae4mJfqqwub57AVlctcaXA9qDOPIvGb10kj3g0HYCXRw9cf0rqNXo4XBpUYIZtRGSwCUshmPWjfTS5qnYXaZhxDI95y5dB575jCr1wIDc3fVxAaB_0Lxnsg8v1FvfAiXLLXZk-NWbt5AraiSI9cLUfnxRcJd_aN9tyVxDIMX3Co_VUBQW49QEKkoYgqDRZMy778P3A4mUqzQ9lVjBT2XwmLN2xNJZPyMy3M_TYOGNJW3mba8EGDhorukSJ7E13yPCxPZTt6qsCRI6ylRXA3A_xpbqO2PJglEP3vu2cNk9-wk5_PluHCZHmSE2QMTdHHpUK6bbIIX01CJ_11ZLGVAEdxuSo7fcH5nfhYm47s4AHfcbLi3LxRJhCmen3Xk28-LB36_Y4JzSBiXIaIH7bA8CKmQz9fknenPFTIGOlDmE-VAwOtd61Qha4_XBuS3YptvuPbLHnN5JbHrouSLJ82oPl0-KYpUmLvuGNpmwgCcUD49cl2R7mADfjf-qEtcieIdf093rFz3DOOL4jpQ7rHKzZVhYWRDmUjtr4ymYx6p1R1oGnB-IgK9uWYdGUaHbfQBG6WSm8Ho3AIMwKZayn6OPKfg6J0Ea4Mu6tZ_eMAVxfRr7-9ns9JsEADxFldwIotjoBLjFwC6jAmoLvZ93fZERL7oBLP7gPUm8ktSSv5GVhJ9YlBuIecl2sOE2nLJJDcdEMitk4LSBnrMpJ_4tFXRlKgEy5f_4xGY7_QgPq7sDpdZj9rYK6wRl8aM2xSisHl5y7tzqwY3f79wxA-Q2hBhfta9OGUOL8HGNgkm4u3W3AwdG5prTNiHwyUixa95kAj45p4nIEBnvBLAFFr55KbI9WXN0o3oF4K2plzzcQSYS2IulI2mCWDpsJ-dPvElwv2H2GLhHvTVlCurj9C6jpZJatfvEbRnNHLadWmZKgDFk9ETSmhW10X5O10ErvaW0RNoe8FBmVAFbLn4XgGtRsPAUrxg5TB8-StE_YLc1eC3_2DD8UJuW6wQEpJDOpMRI0JeMJZ9tUNkKPYY99P9DGBG0_Qz_Vsh_IVQZZ9kAdLw3ZRgLa9buwNwGjDwb06nbpbwrULI1twEEo-zgh5aKtu2qXmcxUgJMxChvPAiY7DnwNY6tcO3RiGwJH7HimOt-cwZ0XGl1qEe6F16cYNVMb-hT_bO7ty-PCJ-lDWkrk7Fs6-Im6pJE7D0NlcjmYbpkaJ4MAfxGHgEwNpzj4osfMxP2Avt99jTKUTXgK4KKJGqbuhdWY01aFN2kM_Z2LUnG6twJYvMd3JwEQnf4cibmgVmLvdVwcKXoLNfU5JXdKKvGZD-o8_K6cemVZIDb9mcjEUekavXxu-phckit99AmxxmnH3mkeOlyxcpR9PzZmZtz3i1NTxAuw3rpseBS6fo4XDc1sKsiVLtF0kK39BgRCIydpZVDNcfb54csFGTSZtY7q4YjY86gZTJpppV2oY6uF3HJ1f8qWCzcGVLTD2CCot0Msy3hbmfuFdk5bGR4-s-Pq1AVW8_wGYV_AOez6v5WfOcIKrnnkRI2-lmJOFH3w7r-Y-ybrPgOJf5Zzs_Pwv36yHmIxe3li-eYhSqpj9-DlQvtl5s-fy4tRpRM7hojbhMQVVOffXY9wh76eDR0oWSZH_UZQZPcrW0PltuyuFAfpUmyB1MUpsNJQA4Jp_wXgxE5JH9zjZcOHPHf0zNba4BRFMU2_bkZ278bqI9AkqkYIxZtx5xIdSD8dzk4NGWKiAB7s6BJX2OIjnK2JV3JL7fKobStpYC-OQMBSiq3gu9EY6oMrm5B_hu0InRMf2cPBBaJ9FnBkUGeUHzsXuk1b0OWWkMRb5Go_yqcr29fpCu9ZpljE2HcR5UXMdrq8sYAooNy95zsHAJezDB-Lk_9vEgEc7hTlBYmIV96gM4Ts52zupM4M_grVjKcJDFuJ6eXDCg4MIQlQdLr6EszsFRT_mivKWvBWT6-mqavBtrg8zrGII3AZYHqHD9H6xtI-q6n65beDwin0yDgasT75qG83Vg7etLYx8LphgTSFUmIZ-kU-IUusEYZTvqxbDs9nSREEa6jPrqFUSZQ1fF_ddP52HkvNyfMdEZxsgmJlzrOqifCkYDv72e_S1RUoeFUfiJx4U3I1P3O6HO2r-iol8EgxKyhJKeeKou_vyMOksU6KQOkCeb4sLyYD5CpMa_4FgBAdeuxdDzSuz4RhuEW2h-tTzFu7dL03_FbuRWuF4OK9MG-EdrrZDyFSWO5eck1EiEgO0GfXxwA9HrmR15g9KQYV5sTc6jfCkSg00WKT76o0AV4cdDmId_k4rVNZ1PjsiSh1EijAGNjDFS2_OJUPr9Go3YrDtKrjn-gt2OrU_jmzWG-5FK7JIBWIhS_sW1phMR3EYSpRWRkTc_JGWmwG0ThyxmGt61teP1yh3jPioeMMGT7Bmam7hplHfJwrcIRb29nBeNgjlrfgtpoJzc52IaaXYTBHFBQqjEImFTa_-jItsEA4Hale9EMBArb54cC408BLDEth9jWJ5fXbpNuOmp_FZAMFaKq3nzBiyvEjBkjQbxuPoXNMB0o9h4AcTUB6UW8IekURBR05crjvNpcFu4&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fsimcast.com%2F&ds=l&xdt=1&iif=1&cor=7964317497358542000&adk=3944675600&idt=278&cac=0&dtd=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 07:58:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25316
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 20 Nov 2024 07:58:52 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI3MzY4MwogIHNlcnZlcl9pcDogMTM1Mzk2MTExCiAgcHJvY2Vzc19pZDogMTc0NTA3ODM2Nwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 5142 0
497 B 154ms
67ms Image
image/png 142.250.185.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMDU3ODg0ODI3MzY4MwogIHNlcnZlcl9pcDogMTM1Mzk2MTExCiAgcHJvY2Vzc19pZDogMTc0NTA3ODM2Nwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiA4MTQ0NTY5NDc0MjYxMTAyODQzCmRlYnVnX2tleTogMTAzNTE5OTAzOTE3MDMyODMzOTEKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTIxIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIyNTk3NDEKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY2MDE0MjA2MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIxMjMyMAogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0x984268f4ac155ed20000000000000000","13":"0x9cd37ff3a860083e0000000000000000","14":"0x25163c75e41ae86b0000000000000000","15":"0x5f0c1d01f29745670000000000000000"},"debug_key":"10351990391703283391","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"8144569474261102843"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK wmoiqux43uzw Show response
hal9000.redintelligence.net/zone/ Frame 5142 12 KB
4 KB 100ms
14ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/wmoiqux43uzw?subid=&gdpr=&gdpr_consent=&rnd=1700578847175183&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC81myH8ZcZc_YCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Q5mmL3z1eJRKAkLB0_auPH_R1UgFap8aQliArGDGeOkyr2mAdcxDxAhaXdZMtzEm4wLscdfDXVcGikqg_tBYsGOhSdco-t0uJOl0cozzl5vne9javx_XJMhTu8u9KXW5ldAaOFezK1CEYzFXOM90XagtICLiY8I2w6TmXmijPqulrar-DVH7m4gp4J0UBzXk2pUl7uAvBIH-keTyrG8alsqIYD-jfIeTqwyrogZ1R36dR76f7KQzMXcSZ8LXXEesnRmXKtXfItKrd4ZOhiunPctchPoVwRazQyVokhueDprbuSdkEiyjX8HU_9GC47WwmQ8put1i2K3dDVqgNX-WTwY2XZuv8sB96x9_3RozgGr_LPfDM-MAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiKnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_21vMgWGYJxCqPD1CH1huYXwwu9ow%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-C7YV7l8TsIyQxd2XRw5bYpW-vp4AOZtakUs7tGnZrKd1y05hAG6dB8gUFS-ZFzp5x3teUb7DYu1TSY3JYPWU-fSdc6iQEx9CrYY5A0agOI8FB7a9_BRGY7qm7uGTmyLgCEJDY8eDcGFLXizdZ7zV5gnUkeAhDGMBQl6KNWaBDpibM7r24%26cry%3D1%26dbm_d%3DAKAmf-AclDEOII1BP_t-yb5Tts0MEQZsekYxBgauZCHVOtuLbVy8O6bv9Nev6CyqGy88m0nEM8wu7YuXokUiS7IfLgAZoUBr6FG-dBXfjRoqOxjJD-HWO2pDddAQVjcuzGH7hT3WUWKTZdOwXbvxD7beW1mnubCGFVSfw-C7pUdOqCFMB1VZOsi07uho2zHgU5MnRPUA5BPXqFY06Ezj0-zI52KWiySh2PPrhjvXZgyBX6Kd2FwTDAprbvZsjC3ReJSJF3os7ketl8lBoqxUzaNVyZ9LumeVlTUOPh97TygerH6GMO8MyiietNmbfu6ji-GBxpZO-ycmrHflKJO_DV9kS6dMYbJlCpXpVB-_JBQCrsGJYuxchvC969wsS21K12u953tvsZDxLOCtYyyH0ESCjnfmzaBP7D3rnCZGJUNJ7jvuTBo_lxdh88qJ25q1HYg6v8fCG4eNkJjRFXFtF7E7gAG53T8bU6TUPRK830Mc_AqzXpIkQKFBbDfZdXQqJZfzLVSNEOZbtyrpRtDW1o3uf7hmKbRyf4yT_7jkHTH0JvqzX9jIXFC2ZMVsYLLcoXvuff_axWwH-9k4FiRb1OB_1zHSt6wmrw%26adurl%3D
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1fc2381411e5796f36bead15fee9242185014b9a1d4d1f345013a071ccd919e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4266
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 11FC 38 KB
13 KB 19ms
19ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F4B2 38 KB
13 KB 22ms
21ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 564F 38 KB
13 KB 20ms
19ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F72A 38 KB
13 KB 22ms
20ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 59EE 38 KB
13 KB 28ms
27ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 25316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 07:58:52 GMT
expires: Wed, 20 Nov 2024 07:58:52 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal900012.redintelligence.net/ Frame 046F
Redirect Chain

https://hal900012.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=ce9175309d&subid=&uid=fe93a7cbb3fa11fa&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900012.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=ce9175309d&subid=&uid=fe93a7cbb3fa11fa&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

123ms
84ms

Script
application/x-javascript

94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=ce9175309d&subid=&uid=fe93a7cbb3fa11fa&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC9T6tH8ZcZdPYCprQ3gO2j73gCqblvaBpnZecp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QkIZhE2p7XLyiVKLbmGL8ydYRIitA2ZqUa2a8_cvmCE9Yw4V5Z0lLIZg091lx_TOYBa6rUEtKtNRkCXTUXtDDfBjnM8i4llldyhFQbp_q8EIohZzhvQok8tmW6UI8KW04locBL5r5T15mOxqZ-1tLNJgoaIlCcj3vSbirSN3B2jooLfAC3Gry5arDzu5yZaahBftT1_9NM4shAiubxyOMnB-36mih7zCAdDTGWL9schcbU8v14pbKw9FtahcNMXsr165qVXrXkOKDhGEdEPD9U-NiQSYXnb5o-3T6pWX8QEE04T6cMP_AsGTaLHa30ate6Dbbah4Fs5FKAgL9-bxfg3or94WroABv2AGtc0Vc9gnz4_NcwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCI2c4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_05ZeteFSShquxyRIki0PwrS3hvNA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AjzsKfxkAg4dUBEKH_mphaOc8qw19KYmLWSITAF4EFWszUDR8b2CW1CIbVBzy0-wtFBg2Qc5UoVI95yG-yeoXV5s3fZni_9PfXHjutY5UgZdG8_rmvdrfEJW6Lddw7J8OHBgrmabErSL0YmecJGqoBAGvhychU-zXqjscBVT3EmiLBJrs%26cry%3D1%26dbm_d%3DAKAmf-Cr58V-PzhMZIqX2ReI3zxL7Pl5poWQw0mmDOoiLywHVbzvBSX3J55oPH8yi9G3Q1SNleCbFi_IPOpvqJymp6BZ59rq4CevDppWjo6Lqs_qSm_qgRavrT5pCo2IWPtp0AFm0WoEvngbQx3wJhF9KodzMlcd5FxfxToljRzWFvpe9Zvbjk7sT53kTU1I43zhmPJslP9bit9eNtdeAUz_FWCiV3rl3puoImSG721KxpJT-v284r_bxlH0vIqju29mJqv4n6DFsJuv6zEittlB2S4LiQF2NGqme97A2UbPazvVVU0qFfadz9q2z8NkI6bXwcCp70G5YdCKGTpqexuJ9S_306T00rIdXlX_QIi68aUoSvQ_eOOm-fC0l3Jrv1fj8_tBgq1WUiKRdrrl95WSavMwsqSmMa8batE-UVT8ng4mGSGyVh7ghsUC4XtZVFfVfjltDLQmiDR3O4lmskygP16NCX4VkQfypXfKuIy0prXqbv81oY-52v_OrSX1_gFTKARIl2FjkT-BXeTDLHMuga5BebbWltCbZS5OJ7tqIszI_UPxg7s5GMjbkb3dqoi2UzJcIY1-MEQUGbF2_Pe_XS2c5ov_ag%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8661801246743&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 2ff0df117bbbefd8674d9d0e7e8ae8575000baabca33a23a97460c18af42521c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 46944100097592304445002012515012
Connection: close
Content-Length: 1326
Expires: Tue, 21 Nov 2023 15:00:48 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=ce9175309d&subid=&uid=fe93a7cbb3fa11fa&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC9T6tH8ZcZdPYCprQ3gO2j73gCqblvaBpnZecp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QkIZhE2p7XLyiVKLbmGL8ydYRIitA2ZqUa2a8_cvmCE9Yw4V5Z0lLIZg091lx_TOYBa6rUEtKtNRkCXTUXtDDfBjnM8i4llldyhFQbp_q8EIohZzhvQok8tmW6UI8KW04locBL5r5T15mOxqZ-1tLNJgoaIlCcj3vSbirSN3B2jooLfAC3Gry5arDzu5yZaahBftT1_9NM4shAiubxyOMnB-36mih7zCAdDTGWL9schcbU8v14pbKw9FtahcNMXsr165qVXrXkOKDhGEdEPD9U-NiQSYXnb5o-3T6pWX8QEE04T6cMP_AsGTaLHa30ate6Dbbah4Fs5FKAgL9-bxfg3or94WroABv2AGtc0Vc9gnz4_NcwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCI2c4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_05ZeteFSShquxyRIki0PwrS3hvNA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AjzsKfxkAg4dUBEKH_mphaOc8qw19KYmLWSITAF4EFWszUDR8b2CW1CIbVBzy0-wtFBg2Qc5UoVI95yG-yeoXV5s3fZni_9PfXHjutY5UgZdG8_rmvdrfEJW6Lddw7J8OHBgrmabErSL0YmecJGqoBAGvhychU-zXqjscBVT3EmiLBJrs%26cry%3D1%26dbm_d%3DAKAmf-Cr58V-PzhMZIqX2ReI3zxL7Pl5poWQw0mmDOoiLywHVbzvBSX3J55oPH8yi9G3Q1SNleCbFi_IPOpvqJymp6BZ59rq4CevDppWjo6Lqs_qSm_qgRavrT5pCo2IWPtp0AFm0WoEvngbQx3wJhF9KodzMlcd5FxfxToljRzWFvpe9Zvbjk7sT53kTU1I43zhmPJslP9bit9eNtdeAUz_FWCiV3rl3puoImSG721KxpJT-v284r_bxlH0vIqju29mJqv4n6DFsJuv6zEittlB2S4LiQF2NGqme97A2UbPazvVVU0qFfadz9q2z8NkI6bXwcCp70G5YdCKGTpqexuJ9S_306T00rIdXlX_QIi68aUoSvQ_eOOm-fC0l3Jrv1fj8_tBgq1WUiKRdrrl95WSavMwsqSmMa8batE-UVT8ng4mGSGyVh7ghsUC4XtZVFfVfjltDLQmiDR3O4lmskygP16NCX4VkQfypXfKuIy0prXqbv81oY-52v_OrSX1_gFTKARIl2FjkT-BXeTDLHMuga5BebbWltCbZS5OJ7tqIszI_UPxg7s5GMjbkb3dqoi2UzJcIY1-MEQUGbF2_Pe_XS2c5ov_ag%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8661801246743&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:48 +0100

GET
H/1.1

200
OK

request.php Show response
hal900010.redintelligence.net/ Frame DCC3
Redirect Chain

https://hal900010.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=43c836ad73&subid=&uid=29dc9b13adf63ff7&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900010.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=43c836ad73&subid=&uid=29dc9b13adf63ff7&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

158ms
129ms

Script
application/x-javascript

138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=43c836ad73&subid=&uid=29dc9b13adf63ff7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4MLoH8ZcZc3YCprQ3gO2j73gCqblvaBplZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSUAk_QUkPDJc52dBdoQ4mVD6E6sV4qDJf1ivJvcIc-7nw-gk-EWa-VqLJj7Sryb1KcVFDwdI5qkYcjjQZ2AbHMg5y0UK3bVj--NnA4puN1pU6_q3-rsYIJ8ZbIM3Gu1nht63Spebuu3GE6sb7KHfp_eii0CcIs19m5ccfopei1uMDYtIJp9mO54JfNmx9jqHLPH1Vcy_Zhw_twacJ9UUAHJi6zae8UNwHqixGZIj9OhM-iRPUXJ7-o2PXYF2HK8X_1BvKO89W-illyGMRSs1CxRfmrDZla6jWvUlUrJAvKEPLfv0IhufJRD6a46H7JHgRK55awTLBbp0P5zd1tQ1s7wqJuGA9VzS_xHU8DvL5nKT0yRD0DlMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiJnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2nY99TnNIPnKAuuVrjl7UWnuLE4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BFgxdEPMjEh5FGasfFRYBLMuPAKz1XYJ6l9HMunyypBtnyoUn2nZQ3sej2z2xVKGfRbQefhyL6tmoUBARmWqpAYPY0e53xC7K_aYVBT-R8Dk0VDzcVfzw2KyfHaabi72x-l2WY4iZ8XyNl8do1NHje1XN4yPb-_eZlA_i_ax_Ln7QUHZ8%26cry%3D1%26dbm_d%3DAKAmf-DPrigxJGOWiVqdTU7Vsxsl_aYK8-yxXqB_aqxl02R39s_uq5fcFkzFafh1PnftBLA6qP4s6nGDcm5VXvCipflWe6eCWN_7cwjwa8OM2QjwqLPYpgPUhaZSiATMA9ZR8i1zyViZiEw_sHY6tLsYLvxiqi8N11umd33w48vpqxlIOhVcl09odct7ZRpOMWzJscnhxeeyi3yrwo7wt1u5JW_D1vzhc14QwPu2945y3qtcUIiDiq7svOvG1PChRVsfsFug_IaAlV9tm6hX3VdlKQCG-eYt_nLT7s7SOAGJyD6Y0fkopgupK6rT_1Aml1tgSnEC6H_SfDPq3n4tyivtjMhZaCNY6TnfnSvPzNsTDmE_t1DlAKzhHlPXz6Ja4E7dvfwrQz3x8sIxSl8kqJkcjaFt4T2jB-XCDRxVDgD_yCRG6y9TQtgnUEUKCp4GA-6Y3NnrQKVqm5P2RXXLlbMGvySsMWDRvBl1rXgtw_xr4V2g8yGwHOIwGcECnCdoKMTWuHnP9mVQVgc73U8qbU_VJEZ7h-NaHfyshXdmLAd6DKCOIrNS8mrHeabT0XDhbfkJUMVLdOIrzyPokXTA_vwSGQWOQ4fckg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6440066283224&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5014ac87e8cfbdcb63d7be743bf06adc1ffac5afe50607aa76955d523d1c400f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 42777500112678604444990012515010
Connection: close
Content-Length: 1372
Expires: Tue, 21 Nov 2023 15:00:48 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=43c836ad73&subid=&uid=29dc9b13adf63ff7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4MLoH8ZcZc3YCprQ3gO2j73gCqblvaBplZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSUAk_QUkPDJc52dBdoQ4mVD6E6sV4qDJf1ivJvcIc-7nw-gk-EWa-VqLJj7Sryb1KcVFDwdI5qkYcjjQZ2AbHMg5y0UK3bVj--NnA4puN1pU6_q3-rsYIJ8ZbIM3Gu1nht63Spebuu3GE6sb7KHfp_eii0CcIs19m5ccfopei1uMDYtIJp9mO54JfNmx9jqHLPH1Vcy_Zhw_twacJ9UUAHJi6zae8UNwHqixGZIj9OhM-iRPUXJ7-o2PXYF2HK8X_1BvKO89W-illyGMRSs1CxRfmrDZla6jWvUlUrJAvKEPLfv0IhufJRD6a46H7JHgRK55awTLBbp0P5zd1tQ1s7wqJuGA9VzS_xHU8DvL5nKT0yRD0DlMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiJnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2nY99TnNIPnKAuuVrjl7UWnuLE4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BFgxdEPMjEh5FGasfFRYBLMuPAKz1XYJ6l9HMunyypBtnyoUn2nZQ3sej2z2xVKGfRbQefhyL6tmoUBARmWqpAYPY0e53xC7K_aYVBT-R8Dk0VDzcVfzw2KyfHaabi72x-l2WY4iZ8XyNl8do1NHje1XN4yPb-_eZlA_i_ax_Ln7QUHZ8%26cry%3D1%26dbm_d%3DAKAmf-DPrigxJGOWiVqdTU7Vsxsl_aYK8-yxXqB_aqxl02R39s_uq5fcFkzFafh1PnftBLA6qP4s6nGDcm5VXvCipflWe6eCWN_7cwjwa8OM2QjwqLPYpgPUhaZSiATMA9ZR8i1zyViZiEw_sHY6tLsYLvxiqi8N11umd33w48vpqxlIOhVcl09odct7ZRpOMWzJscnhxeeyi3yrwo7wt1u5JW_D1vzhc14QwPu2945y3qtcUIiDiq7svOvG1PChRVsfsFug_IaAlV9tm6hX3VdlKQCG-eYt_nLT7s7SOAGJyD6Y0fkopgupK6rT_1Aml1tgSnEC6H_SfDPq3n4tyivtjMhZaCNY6TnfnSvPzNsTDmE_t1DlAKzhHlPXz6Ja4E7dvfwrQz3x8sIxSl8kqJkcjaFt4T2jB-XCDRxVDgD_yCRG6y9TQtgnUEUKCp4GA-6Y3NnrQKVqm5P2RXXLlbMGvySsMWDRvBl1rXgtw_xr4V2g8yGwHOIwGcECnCdoKMTWuHnP9mVQVgc73U8qbU_VJEZ7h-NaHfyshXdmLAd6DKCOIrNS8mrHeabT0XDhbfkJUMVLdOIrzyPokXTA_vwSGQWOQ4fckg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6440066283224&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:48 +0100

GET
H/1.1

200
OK

request.php Show response
hal90004.redintelligence.net/ Frame 5142
Redirect Chain

https://hal90004.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=07f52c37d3&subid=&uid=9ca731d48ba03963&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90004.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=07f52c37d3&subid=&uid=9ca731d48ba03963&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

130ms
95ms

Script
application/x-javascript

138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=07f52c37d3&subid=&uid=9ca731d48ba03963&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC81myH8ZcZc_YCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Q5mmL3z1eJRKAkLB0_auPH_R1UgFap8aQliArGDGeOkyr2mAdcxDxAhaXdZMtzEm4wLscdfDXVcGikqg_tBYsGOhSdco-t0uJOl0cozzl5vne9javx_XJMhTu8u9KXW5ldAaOFezK1CEYzFXOM90XagtICLiY8I2w6TmXmijPqulrar-DVH7m4gp4J0UBzXk2pUl7uAvBIH-keTyrG8alsqIYD-jfIeTqwyrogZ1R36dR76f7KQzMXcSZ8LXXEesnRmXKtXfItKrd4ZOhiunPctchPoVwRazQyVokhueDprbuSdkEiyjX8HU_9GC47WwmQ8put1i2K3dDVqgNX-WTwY2XZuv8sB96x9_3RozgGr_LPfDM-MAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiKnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_21vMgWGYJxCqPD1CH1huYXwwu9ow%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-C7YV7l8TsIyQxd2XRw5bYpW-vp4AOZtakUs7tGnZrKd1y05hAG6dB8gUFS-ZFzp5x3teUb7DYu1TSY3JYPWU-fSdc6iQEx9CrYY5A0agOI8FB7a9_BRGY7qm7uGTmyLgCEJDY8eDcGFLXizdZ7zV5gnUkeAhDGMBQl6KNWaBDpibM7r24%26cry%3D1%26dbm_d%3DAKAmf-AclDEOII1BP_t-yb5Tts0MEQZsekYxBgauZCHVOtuLbVy8O6bv9Nev6CyqGy88m0nEM8wu7YuXokUiS7IfLgAZoUBr6FG-dBXfjRoqOxjJD-HWO2pDddAQVjcuzGH7hT3WUWKTZdOwXbvxD7beW1mnubCGFVSfw-C7pUdOqCFMB1VZOsi07uho2zHgU5MnRPUA5BPXqFY06Ezj0-zI52KWiySh2PPrhjvXZgyBX6Kd2FwTDAprbvZsjC3ReJSJF3os7ketl8lBoqxUzaNVyZ9LumeVlTUOPh97TygerH6GMO8MyiietNmbfu6ji-GBxpZO-ycmrHflKJO_DV9kS6dMYbJlCpXpVB-_JBQCrsGJYuxchvC969wsS21K12u953tvsZDxLOCtYyyH0ESCjnfmzaBP7D3rnCZGJUNJ7jvuTBo_lxdh88qJ25q1HYg6v8fCG4eNkJjRFXFtF7E7gAG53T8bU6TUPRK830Mc_AqzXpIkQKFBbDfZdXQqJZfzLVSNEOZbtyrpRtDW1o3uf7hmKbRyf4yT_7jkHTH0JvqzX9jIXFC2ZMVsYLLcoXvuff_axWwH-9k4FiRb1OB_1zHSt6wmrw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3601819351280&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b0f71603c8ffaaa0ef310c17fe889d6d0b3dc41973888a654533d9a98e59946d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 38667000106723804444994012515004
Connection: close
Content-Length: 1327
Expires: Tue, 21 Nov 2023 15:00:48 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=07f52c37d3&subid=&uid=9ca731d48ba03963&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC81myH8ZcZc_YCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Q5mmL3z1eJRKAkLB0_auPH_R1UgFap8aQliArGDGeOkyr2mAdcxDxAhaXdZMtzEm4wLscdfDXVcGikqg_tBYsGOhSdco-t0uJOl0cozzl5vne9javx_XJMhTu8u9KXW5ldAaOFezK1CEYzFXOM90XagtICLiY8I2w6TmXmijPqulrar-DVH7m4gp4J0UBzXk2pUl7uAvBIH-keTyrG8alsqIYD-jfIeTqwyrogZ1R36dR76f7KQzMXcSZ8LXXEesnRmXKtXfItKrd4ZOhiunPctchPoVwRazQyVokhueDprbuSdkEiyjX8HU_9GC47WwmQ8put1i2K3dDVqgNX-WTwY2XZuv8sB96x9_3RozgGr_LPfDM-MAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiKnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_21vMgWGYJxCqPD1CH1huYXwwu9ow%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-C7YV7l8TsIyQxd2XRw5bYpW-vp4AOZtakUs7tGnZrKd1y05hAG6dB8gUFS-ZFzp5x3teUb7DYu1TSY3JYPWU-fSdc6iQEx9CrYY5A0agOI8FB7a9_BRGY7qm7uGTmyLgCEJDY8eDcGFLXizdZ7zV5gnUkeAhDGMBQl6KNWaBDpibM7r24%26cry%3D1%26dbm_d%3DAKAmf-AclDEOII1BP_t-yb5Tts0MEQZsekYxBgauZCHVOtuLbVy8O6bv9Nev6CyqGy88m0nEM8wu7YuXokUiS7IfLgAZoUBr6FG-dBXfjRoqOxjJD-HWO2pDddAQVjcuzGH7hT3WUWKTZdOwXbvxD7beW1mnubCGFVSfw-C7pUdOqCFMB1VZOsi07uho2zHgU5MnRPUA5BPXqFY06Ezj0-zI52KWiySh2PPrhjvXZgyBX6Kd2FwTDAprbvZsjC3ReJSJF3os7ketl8lBoqxUzaNVyZ9LumeVlTUOPh97TygerH6GMO8MyiietNmbfu6ji-GBxpZO-ycmrHflKJO_DV9kS6dMYbJlCpXpVB-_JBQCrsGJYuxchvC969wsS21K12u953tvsZDxLOCtYyyH0ESCjnfmzaBP7D3rnCZGJUNJ7jvuTBo_lxdh88qJ25q1HYg6v8fCG4eNkJjRFXFtF7E7gAG53T8bU6TUPRK830Mc_AqzXpIkQKFBbDfZdXQqJZfzLVSNEOZbtyrpRtDW1o3uf7hmKbRyf4yT_7jkHTH0JvqzX9jIXFC2ZMVsYLLcoXvuff_axWwH-9k4FiRb1OB_1zHSt6wmrw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3601819351280&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:48 +0100

GET
H/1.1

200
OK

request.php Show response
hal90005.redintelligence.net/ Frame EDFF
Redirect Chain

https://hal90005.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=215a4e71cb&subid=&uid=1a9d955cc4a04d62&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90005.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=215a4e71cb&subid=&uid=1a9d955cc4a04d62&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

115ms
78ms

Script
application/x-javascript

138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=215a4e71cb&subid=&uid=1a9d955cc4a04d62&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCq79wH8ZcZdDYCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Qd30L4V_gfEBH8JcKzCYu6_bBK560CxhfNMXPm23ICfWULO9ZOHnFjxtU-9VkNMZKI23xx5aMaywmwyYv3vcBYfg8XOAGJiHKF_G0XfMHJOwC03-gV7yA7CzZBOVykZ13RyvL5KqnVaa5P-Z-S0BJ7srzq1SRTFRQW_xpAUV2iWK7xiej76CME4MANZBTq5HBJwks_gzAh-tL1rb6x0hI8pVgxEwK9uZepT203bQoHS6OeEXuM5uNh5OFd9d2Sq82Cj0UoTdKNjHLYX1GDC4Jv_cJ5nX4POfjt68TIcpzRsqBmPwJqF_CLLlDwP7x9Qy1R5lGKIbXmsaVIo6QHRNDRt_ZzLGSu2cTVGr-5hNByMf1JNGTpcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiLnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2M1fFiC7nZPQ5F5-xxbS54p2_tHw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CbfxJpiSVuWA87M6T7cFemqiB2tTMWvruH3ruPOhoqQL3m0QwcvfUJJKHIUt73oSbqxzMqHmM9iIn588soxT15zkH57PfKiY-aKMOynvfYj0mEXL7rOzPa1fG7vWN69yIBpvgpKz0UcjBxpg-eVOATd_TXoUUvg6uV7cHreFrTHl2_yLM%26cry%3D1%26dbm_d%3DAKAmf-A674eyB_TSWrjiN6pr-uoz7kQ41TrO824eS6ZYP0G1N8pbAsRVW6oDHMs5_MjFLtyd5ign2Uap_VwKZZEovzhpC3UJbYPvNTGyWA3TeGP-sWoXMLYAqyEJQT7KfbgzQZJ6XMVaTmtHRt-aXrzm4bu8ZX1qmQn9yTivTIxB4QjnZjvMzAP8m3fzYORb2-3oivor4Cw1i5eygJeCIrVlJGanBDuqUHzYw3uk0TGhkri_O_Ht9tU900Cznd5CereS7AZXbGy0S72g0H7mGZqF0p2AuIgMZduQe8hKid1aTDs9yzyK9h0KVplJmId_rCWManJtGxFVsv3gmjvJJcfCo-zzJkaDK1u17c3wwOleax3AQKqEAr6f0x1IM4JuffK-BPk86bmWt2QGaSi7JDTFjPvd3Z8WnZIkz2_kAwG3CXCJaW8cj3hr6C7cVjDUD68rFVTuu3d0OzU5xL3BA4NaEWovryCIA6Lf63H5Gf7qBlfJZ5gOaUg5fpl7wmb9-yRGlFZaBsLa5rkCsbr-1S834C7aD0mzaI29EUu8CPhHaYOXS1uyT07v7c0-byB3p9yG1lSyDU4BRbblzPu-2e71LDgL49CNpw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4845472815586&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.165 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d2110f3d904129ba4be9e16ceb33f823461b8d6172e9635446615bf8c03ad29f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 83732900102600404444994012515005
Connection: close
Content-Length: 1352
Expires: Tue, 21 Nov 2023 15:00:48 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=215a4e71cb&subid=&uid=1a9d955cc4a04d62&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCq79wH8ZcZdDYCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Qd30L4V_gfEBH8JcKzCYu6_bBK560CxhfNMXPm23ICfWULO9ZOHnFjxtU-9VkNMZKI23xx5aMaywmwyYv3vcBYfg8XOAGJiHKF_G0XfMHJOwC03-gV7yA7CzZBOVykZ13RyvL5KqnVaa5P-Z-S0BJ7srzq1SRTFRQW_xpAUV2iWK7xiej76CME4MANZBTq5HBJwks_gzAh-tL1rb6x0hI8pVgxEwK9uZepT203bQoHS6OeEXuM5uNh5OFd9d2Sq82Cj0UoTdKNjHLYX1GDC4Jv_cJ5nX4POfjt68TIcpzRsqBmPwJqF_CLLlDwP7x9Qy1R5lGKIbXmsaVIo6QHRNDRt_ZzLGSu2cTVGr-5hNByMf1JNGTpcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiLnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2M1fFiC7nZPQ5F5-xxbS54p2_tHw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CbfxJpiSVuWA87M6T7cFemqiB2tTMWvruH3ruPOhoqQL3m0QwcvfUJJKHIUt73oSbqxzMqHmM9iIn588soxT15zkH57PfKiY-aKMOynvfYj0mEXL7rOzPa1fG7vWN69yIBpvgpKz0UcjBxpg-eVOATd_TXoUUvg6uV7cHreFrTHl2_yLM%26cry%3D1%26dbm_d%3DAKAmf-A674eyB_TSWrjiN6pr-uoz7kQ41TrO824eS6ZYP0G1N8pbAsRVW6oDHMs5_MjFLtyd5ign2Uap_VwKZZEovzhpC3UJbYPvNTGyWA3TeGP-sWoXMLYAqyEJQT7KfbgzQZJ6XMVaTmtHRt-aXrzm4bu8ZX1qmQn9yTivTIxB4QjnZjvMzAP8m3fzYORb2-3oivor4Cw1i5eygJeCIrVlJGanBDuqUHzYw3uk0TGhkri_O_Ht9tU900Cznd5CereS7AZXbGy0S72g0H7mGZqF0p2AuIgMZduQe8hKid1aTDs9yzyK9h0KVplJmId_rCWManJtGxFVsv3gmjvJJcfCo-zzJkaDK1u17c3wwOleax3AQKqEAr6f0x1IM4JuffK-BPk86bmWt2QGaSi7JDTFjPvd3Z8WnZIkz2_kAwG3CXCJaW8cj3hr6C7cVjDUD68rFVTuu3d0OzU5xL3BA4NaEWovryCIA6Lf63H5Gf7qBlfJZ5gOaUg5fpl7wmb9-yRGlFZaBsLa5rkCsbr-1S834C7aD0mzaI29EUu8CPhHaYOXS1uyT07v7c0-byB3p9yG1lSyDU4BRbblzPu-2e71LDgL49CNpw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4845472815586&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:48 +0100

GET
H/1.1

200
OK

request.php Show response
hal90009.redintelligence.net/ Frame 9006
Redirect Chain

https://hal90009.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6f6eeefc0c&subid=&uid=af3c95f442acc018&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90009.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6f6eeefc0c&subid=&uid=af3c95f442acc018&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

4 KB
2 KB

114ms
79ms

Script
application/x-javascript

138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6f6eeefc0c&subid=&uid=af3c95f442acc018&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCaOyjH8ZcZdLYCprQ3gO2j73gCqblvaBphZWcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QmD0mzfe7qdTmJTKYjAcr7R_rToZZ3noEWX-5X4U1j43CmZvOQbZKm-Lj4DgDc5z7dQLrvITqEuJ0Hf1m8vDyM6KsAHm9Nu3EL9QBjJDcLry1VQrY__g8p8DO5S6WmjIindMzqL2h_xBC_3Dzr6mIBSz_bI3uTMdMqtQ73jmcy99aO-p9l6qVnpIhwYj-qnJeNeeRUuIkfoBp1NhAn40cuUyb4soTisjDGCByRC9Z8lnuVLpib7AyeXwjsVF1HeTQeXo5v2Ct00jyxIU4YRLfsJS1Pf_VojHby5jRC57F8mCNmEN6H_PYWO7ROTc58mtaaAc2MnsHdUVgDYoOqAla5E52NCzhFcf0vGTyVR0liTuv7V9NwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCIyc4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_1YLCQaZ6QBEJu4GifY-K8zNCOiBw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A96P2zbYRbcY-D9FoSkhf2YiCy85ydHDuHOHTRMVyeA9uI8o3noo8rVWW67-lVvcZiyamIKl8h5R4QoUqXv7blDCwmp5ASFdQiNRdpziI_ceBGEQVg3GMlFzWk3TalMqS8sQa6ZLfiiU2fF0AhQQUI6Ci18TbUjpvVMyY7eVnvoG3E71k%26cry%3D1%26dbm_d%3DAKAmf-Aq0hzcrN7y9axg2fLa1uM1Fl1RhdqxsyHwFbkMBOrqeAA-3JxaWe3igzYfbRRjtBqYUMXheOzoUiG1qhfG5YjKlNjtBL1PnU7_SxlHJdw0YkesYW8rXLVPdnRK6__JwLq1yGOduICbOXo095WDthsvyXogYf5HqKZ7V2Ysg_dwxOvnkJ9eoueYzO6aa4KJT9c0IMt2e8cYHxD_mfTMDs3L8MJDrCJNNdO3CSUQktB1GTYgkQG5r_Fr9grKXv5eZi6JqjhSrlG8qAgvadmqdwFk8ZMcj_RoY8vtP1643dsSa7NDoM9e9YcAVAmMlRI84mpCfYXkIA4dsUlOnY0f1i0BVxK8kV1vweCVftIHYs9Ggs_ONGkPrGr_-1Zqlt8gnXM65zHPejIXSJ4RJ4OFyZZRwSR0XAlOuScrTkLER1wFl-72jFdAbgwUxhD2pPWIUQqTq8LgLBbQJVAoE_sBK4UOv8UxvHvzeX7vcw9SIN-0XCvK2BORFwIpWNQ3115Qplz74YdFR8dJlJZGJRwgdtLj1ZWEBe_j6iRy3tawx4NjrSIa9VbhdwRCXzpgbSKCybNmQoaAYsBZVOZkrliXRyl8dnwK_Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1978184761388&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 009312fcbf5f9a0be5d291b4312f943b0b3a2bfe9ccb024d16271702d8f66518

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 47795800099584704444550012515009
Connection: close
Content-Length: 1348
Expires: Tue, 21 Nov 2023 15:00:48 +0100

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6f6eeefc0c&subid=&uid=af3c95f442acc018&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCaOyjH8ZcZdLYCprQ3gO2j73gCqblvaBphZWcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QmD0mzfe7qdTmJTKYjAcr7R_rToZZ3noEWX-5X4U1j43CmZvOQbZKm-Lj4DgDc5z7dQLrvITqEuJ0Hf1m8vDyM6KsAHm9Nu3EL9QBjJDcLry1VQrY__g8p8DO5S6WmjIindMzqL2h_xBC_3Dzr6mIBSz_bI3uTMdMqtQ73jmcy99aO-p9l6qVnpIhwYj-qnJeNeeRUuIkfoBp1NhAn40cuUyb4soTisjDGCByRC9Z8lnuVLpib7AyeXwjsVF1HeTQeXo5v2Ct00jyxIU4YRLfsJS1Pf_VojHby5jRC57F8mCNmEN6H_PYWO7ROTc58mtaaAc2MnsHdUVgDYoOqAla5E52NCzhFcf0vGTyVR0liTuv7V9NwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCIyc4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_1YLCQaZ6QBEJu4GifY-K8zNCOiBw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A96P2zbYRbcY-D9FoSkhf2YiCy85ydHDuHOHTRMVyeA9uI8o3noo8rVWW67-lVvcZiyamIKl8h5R4QoUqXv7blDCwmp5ASFdQiNRdpziI_ceBGEQVg3GMlFzWk3TalMqS8sQa6ZLfiiU2fF0AhQQUI6Ci18TbUjpvVMyY7eVnvoG3E71k%26cry%3D1%26dbm_d%3DAKAmf-Aq0hzcrN7y9axg2fLa1uM1Fl1RhdqxsyHwFbkMBOrqeAA-3JxaWe3igzYfbRRjtBqYUMXheOzoUiG1qhfG5YjKlNjtBL1PnU7_SxlHJdw0YkesYW8rXLVPdnRK6__JwLq1yGOduICbOXo095WDthsvyXogYf5HqKZ7V2Ysg_dwxOvnkJ9eoueYzO6aa4KJT9c0IMt2e8cYHxD_mfTMDs3L8MJDrCJNNdO3CSUQktB1GTYgkQG5r_Fr9grKXv5eZi6JqjhSrlG8qAgvadmqdwFk8ZMcj_RoY8vtP1643dsSa7NDoM9e9YcAVAmMlRI84mpCfYXkIA4dsUlOnY0f1i0BVxK8kV1vweCVftIHYs9Ggs_ONGkPrGr_-1Zqlt8gnXM65zHPejIXSJ4RJ4OFyZZRwSR0XAlOuScrTkLER1wFl-72jFdAbgwUxhD2pPWIUQqTq8LgLBbQJVAoE_sBK4UOv8UxvHvzeX7vcw9SIN-0XCvK2BORFwIpWNQ3115Qplz74YdFR8dJlJZGJRwgdtLj1ZWEBe_j6iRy3tawx4NjrSIa9VbhdwRCXzpgbSKCybNmQoaAYsBZVOZkrliXRyl8dnwK_Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1978184761388&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Tue, 21 Nov 2023 15:00:48 +0100

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 11FC 39 KB
15 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame F4B2 39 KB
15 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 564F 39 KB
15 KB 24ms
21ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame F72A 39 KB
15 KB 25ms
22ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 59EE 39 KB
15 KB 26ms
23ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H2 200 p-5ce3b907.system.entry.js Show response
tags.qortex.ai/cxo/ 549 KB
127 KB 51ms
50ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: e41780e3be523fb5a473724fb211d62f1895023465dd7da82bded927412d2b54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:15:57 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 81
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0RUvHn%2FbGq3oDVBSTQ4Qb3pGTcYNoBuYTfoXP8eX7fVMSTs4eam9HIQGH1hw1vou7gIxjKJB8BAjayihntxpcC0s3HlBsuey9OMoAnR5CjnowucNxlwG6BhezgDgYudPdtpytRmpMkJiA5ee"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdeb29189170-FRA

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 4E83
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=47795800099584704444550012515009&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=47795800099584704444550012515009&actionid=879111&produktid=ratenkredit&dt_url=

0
201 B

76ms
41ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=47795800099584704444550012515009&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6f6eeefc0c&subid=&uid=af3c95f442acc018&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCaOyjH8ZcZdLYCprQ3gO2j73gCqblvaBphZWcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QmD0mzfe7qdTmJTKYjAcr7R_rToZZ3noEWX-5X4U1j43CmZvOQbZKm-Lj4DgDc5z7dQLrvITqEuJ0Hf1m8vDyM6KsAHm9Nu3EL9QBjJDcLry1VQrY__g8p8DO5S6WmjIindMzqL2h_xBC_3Dzr6mIBSz_bI3uTMdMqtQ73jmcy99aO-p9l6qVnpIhwYj-qnJeNeeRUuIkfoBp1NhAn40cuUyb4soTisjDGCByRC9Z8lnuVLpib7AyeXwjsVF1HeTQeXo5v2Ct00jyxIU4YRLfsJS1Pf_VojHby5jRC57F8mCNmEN6H_PYWO7ROTc58mtaaAc2MnsHdUVgDYoOqAla5E52NCzhFcf0vGTyVR0liTuv7V9NwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCIyc4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_1YLCQaZ6QBEJu4GifY-K8zNCOiBw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A96P2zbYRbcY-D9FoSkhf2YiCy85ydHDuHOHTRMVyeA9uI8o3noo8rVWW67-lVvcZiyamIKl8h5R4QoUqXv7blDCwmp5ASFdQiNRdpziI_ceBGEQVg3GMlFzWk3TalMqS8sQa6ZLfiiU2fF0AhQQUI6Ci18TbUjpvVMyY7eVnvoG3E71k%26cry%3D1%26dbm_d%3DAKAmf-Aq0hzcrN7y9axg2fLa1uM1Fl1RhdqxsyHwFbkMBOrqeAA-3JxaWe3igzYfbRRjtBqYUMXheOzoUiG1qhfG5YjKlNjtBL1PnU7_SxlHJdw0YkesYW8rXLVPdnRK6__JwLq1yGOduICbOXo095WDthsvyXogYf5HqKZ7V2Ysg_dwxOvnkJ9eoueYzO6aa4KJT9c0IMt2e8cYHxD_mfTMDs3L8MJDrCJNNdO3CSUQktB1GTYgkQG5r_Fr9grKXv5eZi6JqjhSrlG8qAgvadmqdwFk8ZMcj_RoY8vtP1643dsSa7NDoM9e9YcAVAmMlRI84mpCfYXkIA4dsUlOnY0f1i0BVxK8kV1vweCVftIHYs9Ggs_ONGkPrGr_-1Zqlt8gnXM65zHPejIXSJ4RJ4OFyZZRwSR0XAlOuScrTkLER1wFl-72jFdAbgwUxhD2pPWIUQqTq8LgLBbQJVAoE_sBK4UOv8UxvHvzeX7vcw9SIN-0XCvK2BORFwIpWNQ3115Qplz74YdFR8dJlJZGJRwgdtLj1ZWEBe_j6iRy3tawx4NjrSIa9VbhdwRCXzpgbSKCybNmQoaAYsBZVOZkrliXRyl8dnwK_Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1978184761388&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=47795800099584704444550012515009&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: B2A2D183:B7EA_91EFC182:01BB_655CC620_67C5AEA:1E878

GET
H2 200 / Show response
adv.office-partner.de/ Frame 561D 930 B
923 B 32ms
9ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request.php?zone=g72h7lz2c4az&nw=20&renderingType=javascript&namespace=6f6eeefc0c&subid=&uid=af3c95f442acc018&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCaOyjH8ZcZdLYCprQ3gO2j73gCqblvaBphZWcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QmD0mzfe7qdTmJTKYjAcr7R_rToZZ3noEWX-5X4U1j43CmZvOQbZKm-Lj4DgDc5z7dQLrvITqEuJ0Hf1m8vDyM6KsAHm9Nu3EL9QBjJDcLry1VQrY__g8p8DO5S6WmjIindMzqL2h_xBC_3Dzr6mIBSz_bI3uTMdMqtQ73jmcy99aO-p9l6qVnpIhwYj-qnJeNeeRUuIkfoBp1NhAn40cuUyb4soTisjDGCByRC9Z8lnuVLpib7AyeXwjsVF1HeTQeXo5v2Ct00jyxIU4YRLfsJS1Pf_VojHby5jRC57F8mCNmEN6H_PYWO7ROTc58mtaaAc2MnsHdUVgDYoOqAla5E52NCzhFcf0vGTyVR0liTuv7V9NwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCIyc4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_1YLCQaZ6QBEJu4GifY-K8zNCOiBw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-A96P2zbYRbcY-D9FoSkhf2YiCy85ydHDuHOHTRMVyeA9uI8o3noo8rVWW67-lVvcZiyamIKl8h5R4QoUqXv7blDCwmp5ASFdQiNRdpziI_ceBGEQVg3GMlFzWk3TalMqS8sQa6ZLfiiU2fF0AhQQUI6Ci18TbUjpvVMyY7eVnvoG3E71k%26cry%3D1%26dbm_d%3DAKAmf-Aq0hzcrN7y9axg2fLa1uM1Fl1RhdqxsyHwFbkMBOrqeAA-3JxaWe3igzYfbRRjtBqYUMXheOzoUiG1qhfG5YjKlNjtBL1PnU7_SxlHJdw0YkesYW8rXLVPdnRK6__JwLq1yGOduICbOXo095WDthsvyXogYf5HqKZ7V2Ysg_dwxOvnkJ9eoueYzO6aa4KJT9c0IMt2e8cYHxD_mfTMDs3L8MJDrCJNNdO3CSUQktB1GTYgkQG5r_Fr9grKXv5eZi6JqjhSrlG8qAgvadmqdwFk8ZMcj_RoY8vtP1643dsSa7NDoM9e9YcAVAmMlRI84mpCfYXkIA4dsUlOnY0f1i0BVxK8kV1vweCVftIHYs9Ggs_ONGkPrGr_-1Zqlt8gnXM65zHPejIXSJ4RJ4OFyZZRwSR0XAlOuScrTkLER1wFl-72jFdAbgwUxhD2pPWIUQqTq8LgLBbQJVAoE_sBK4UOv8UxvHvzeX7vcw9SIN-0XCvK2BORFwIpWNQ3115Qplz74YdFR8dJlJZGJRwgdtLj1ZWEBe_j6iRy3tawx4NjrSIa9VbhdwRCXzpgbSKCybNmQoaAYsBZVOZkrliXRyl8dnwK_Q%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=1978184761388&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 9006
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=47795800099584704444550012515009&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=47795800099584704444550012515009&actionid=879111&produktid=ratenkredit&dt_url=

0
36 B

25ms
24ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=47795800099584704444550012515009&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 21 Nov 2023 04:00:48 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:48 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40027
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B7FA_91EFC182:01BB_655CC620_67CB989:1E87B
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=47795800099584704444550012515009&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 9006 43 B
666 B 184ms
45ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=47795800099584704444550012515009&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B7EC_91EFC182:01BB_655CC620_683FA04:1A42A
x-iplb-instance: 40028
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 9006 43 B
704 B 100ms
78ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=47795800099584704444550012515009&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 110ms
109ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdec5f832c41-FRA
date: Tue, 21 Nov 2023 15:00:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rh3B5H%2BdhvyAM7oMWu%2BTIfoadyHwlxR0GCOKtO4K5MQqni2HUrMorb2174pcPtZvTi6jcyAWAxSMMYQgAkkBZKm2e8NX8bLuUmND4xj1wAa6%2Fn6eeD6zI43vnA%2F1D6i6o54D%2Br%2Fctf%2BHLG58hM4%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
262 B 112ms
112ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BGVCOWlMb494JU3kNkxjx041zzbMjn1MNHQ4HuLixgZjv8DcTtOAYShyc9o6%2BA1R8rDjrLL34Q%2B39O0Q%2BNb2F2EAZ28zHSNU8Tcmg5h1lmVzO9GmLmLs%2FLQFSotrr7n7pIWKZ%2F7xQPOol4xzg7o%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cded084a2c41-FRA
content-length: 0

GET
H2 200 simcast.com Show response
demand.qortex.ai/api/v1/group/configs/stn-12018/ 20 KB
5 KB 215ms
214ms XHR
application/json 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://demand.qortex.ai/api/v1/group/configs/stn-12018/simcast.com
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7d34a1e3754cdcef36a00f7f87080053067738af1b2ee1ff6e059cd65748d87f

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qe8HQiQPGAU8h9maKbrTE0HOvRlYKaCP0XPqhi%2FMWCaz6nw8e2%2FIs3EJj7Qz%2F9HaKyMNAdXZlenYzAy5kJoxBuYzfkLUG19pdW09PHk%2B%2BOeimnxW5K64L4ky2Ytq49%2Bz66K9f17f03O0nJ8rXVc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cf-ray: 8299cdec5f842c41-FRA

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 5C2C
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=83732900102600404444994012515005&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=83732900102600404444994012515005&actionid=879111&produktid=ratenkredit&dt_url=

0
202 B

76ms
41ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=83732900102600404444994012515005&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=215a4e71cb&subid=&uid=1a9d955cc4a04d62&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCq79wH8ZcZdDYCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Qd30L4V_gfEBH8JcKzCYu6_bBK560CxhfNMXPm23ICfWULO9ZOHnFjxtU-9VkNMZKI23xx5aMaywmwyYv3vcBYfg8XOAGJiHKF_G0XfMHJOwC03-gV7yA7CzZBOVykZ13RyvL5KqnVaa5P-Z-S0BJ7srzq1SRTFRQW_xpAUV2iWK7xiej76CME4MANZBTq5HBJwks_gzAh-tL1rb6x0hI8pVgxEwK9uZepT203bQoHS6OeEXuM5uNh5OFd9d2Sq82Cj0UoTdKNjHLYX1GDC4Jv_cJ5nX4POfjt68TIcpzRsqBmPwJqF_CLLlDwP7x9Qy1R5lGKIbXmsaVIo6QHRNDRt_ZzLGSu2cTVGr-5hNByMf1JNGTpcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiLnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2M1fFiC7nZPQ5F5-xxbS54p2_tHw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CbfxJpiSVuWA87M6T7cFemqiB2tTMWvruH3ruPOhoqQL3m0QwcvfUJJKHIUt73oSbqxzMqHmM9iIn588soxT15zkH57PfKiY-aKMOynvfYj0mEXL7rOzPa1fG7vWN69yIBpvgpKz0UcjBxpg-eVOATd_TXoUUvg6uV7cHreFrTHl2_yLM%26cry%3D1%26dbm_d%3DAKAmf-A674eyB_TSWrjiN6pr-uoz7kQ41TrO824eS6ZYP0G1N8pbAsRVW6oDHMs5_MjFLtyd5ign2Uap_VwKZZEovzhpC3UJbYPvNTGyWA3TeGP-sWoXMLYAqyEJQT7KfbgzQZJ6XMVaTmtHRt-aXrzm4bu8ZX1qmQn9yTivTIxB4QjnZjvMzAP8m3fzYORb2-3oivor4Cw1i5eygJeCIrVlJGanBDuqUHzYw3uk0TGhkri_O_Ht9tU900Cznd5CereS7AZXbGy0S72g0H7mGZqF0p2AuIgMZduQe8hKid1aTDs9yzyK9h0KVplJmId_rCWManJtGxFVsv3gmjvJJcfCo-zzJkaDK1u17c3wwOleax3AQKqEAr6f0x1IM4JuffK-BPk86bmWt2QGaSi7JDTFjPvd3Z8WnZIkz2_kAwG3CXCJaW8cj3hr6C7cVjDUD68rFVTuu3d0OzU5xL3BA4NaEWovryCIA6Lf63H5Gf7qBlfJZ5gOaUg5fpl7wmb9-yRGlFZaBsLa5rkCsbr-1S834C7aD0mzaI29EUu8CPhHaYOXS1uyT07v7c0-byB3p9yG1lSyDU4BRbblzPu-2e71LDgL49CNpw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4845472815586&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=83732900102600404444994012515005&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: B2A2D183:B7EC_91EFC182:01BB_655CC620_683F9FB:1A42A

GET
H2 200 / Show response
adv.office-partner.de/ Frame E691 930 B
922 B 11ms
10ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=215a4e71cb&subid=&uid=1a9d955cc4a04d62&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCq79wH8ZcZdDYCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Qd30L4V_gfEBH8JcKzCYu6_bBK560CxhfNMXPm23ICfWULO9ZOHnFjxtU-9VkNMZKI23xx5aMaywmwyYv3vcBYfg8XOAGJiHKF_G0XfMHJOwC03-gV7yA7CzZBOVykZ13RyvL5KqnVaa5P-Z-S0BJ7srzq1SRTFRQW_xpAUV2iWK7xiej76CME4MANZBTq5HBJwks_gzAh-tL1rb6x0hI8pVgxEwK9uZepT203bQoHS6OeEXuM5uNh5OFd9d2Sq82Cj0UoTdKNjHLYX1GDC4Jv_cJ5nX4POfjt68TIcpzRsqBmPwJqF_CLLlDwP7x9Qy1R5lGKIbXmsaVIo6QHRNDRt_ZzLGSu2cTVGr-5hNByMf1JNGTpcAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiLnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2M1fFiC7nZPQ5F5-xxbS54p2_tHw%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-CbfxJpiSVuWA87M6T7cFemqiB2tTMWvruH3ruPOhoqQL3m0QwcvfUJJKHIUt73oSbqxzMqHmM9iIn588soxT15zkH57PfKiY-aKMOynvfYj0mEXL7rOzPa1fG7vWN69yIBpvgpKz0UcjBxpg-eVOATd_TXoUUvg6uV7cHreFrTHl2_yLM%26cry%3D1%26dbm_d%3DAKAmf-A674eyB_TSWrjiN6pr-uoz7kQ41TrO824eS6ZYP0G1N8pbAsRVW6oDHMs5_MjFLtyd5ign2Uap_VwKZZEovzhpC3UJbYPvNTGyWA3TeGP-sWoXMLYAqyEJQT7KfbgzQZJ6XMVaTmtHRt-aXrzm4bu8ZX1qmQn9yTivTIxB4QjnZjvMzAP8m3fzYORb2-3oivor4Cw1i5eygJeCIrVlJGanBDuqUHzYw3uk0TGhkri_O_Ht9tU900Cznd5CereS7AZXbGy0S72g0H7mGZqF0p2AuIgMZduQe8hKid1aTDs9yzyK9h0KVplJmId_rCWManJtGxFVsv3gmjvJJcfCo-zzJkaDK1u17c3wwOleax3AQKqEAr6f0x1IM4JuffK-BPk86bmWt2QGaSi7JDTFjPvd3Z8WnZIkz2_kAwG3CXCJaW8cj3hr6C7cVjDUD68rFVTuu3d0OzU5xL3BA4NaEWovryCIA6Lf63H5Gf7qBlfJZ5gOaUg5fpl7wmb9-yRGlFZaBsLa5rkCsbr-1S834C7aD0mzaI29EUu8CPhHaYOXS1uyT07v7c0-byB3p9yG1lSyDU4BRbblzPu-2e71LDgL49CNpw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=4845472815586&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame EDFF
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=83732900102600404444994012515005&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=83732900102600404444994012515005&actionid=879111&produktid=ratenkredit&dt_url=

0
158 B

538ms
538ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=83732900102600404444994012515005&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Tue, 21 Nov 2023 04:00:49 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:48 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40027
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B7FC_91EFC182:01BB_655CC620_67CB98A:1E87B
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=83732900102600404444994012515005&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame EDFF 43 B
666 B 161ms
43ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=83732900102600404444994012515005&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B7EA_91EFC182:01BB_655CC620_67C5AEE:1E878
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame EDFF 43 B
704 B 286ms
265ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=83732900102600404444994012515005&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame B414
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=46944100097592304445002012515012&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=46944100097592304445002012515012&actionid=879111&produktid=ratenkredit&dt_url=

0
629 B

54ms
31ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=46944100097592304445002012515012&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=ce9175309d&subid=&uid=fe93a7cbb3fa11fa&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC9T6tH8ZcZdPYCprQ3gO2j73gCqblvaBpnZecp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QkIZhE2p7XLyiVKLbmGL8ydYRIitA2ZqUa2a8_cvmCE9Yw4V5Z0lLIZg091lx_TOYBa6rUEtKtNRkCXTUXtDDfBjnM8i4llldyhFQbp_q8EIohZzhvQok8tmW6UI8KW04locBL5r5T15mOxqZ-1tLNJgoaIlCcj3vSbirSN3B2jooLfAC3Gry5arDzu5yZaahBftT1_9NM4shAiubxyOMnB-36mih7zCAdDTGWL9schcbU8v14pbKw9FtahcNMXsr165qVXrXkOKDhGEdEPD9U-NiQSYXnb5o-3T6pWX8QEE04T6cMP_AsGTaLHa30ate6Dbbah4Fs5FKAgL9-bxfg3or94WroABv2AGtc0Vc9gnz4_NcwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCI2c4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_05ZeteFSShquxyRIki0PwrS3hvNA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AjzsKfxkAg4dUBEKH_mphaOc8qw19KYmLWSITAF4EFWszUDR8b2CW1CIbVBzy0-wtFBg2Qc5UoVI95yG-yeoXV5s3fZni_9PfXHjutY5UgZdG8_rmvdrfEJW6Lddw7J8OHBgrmabErSL0YmecJGqoBAGvhychU-zXqjscBVT3EmiLBJrs%26cry%3D1%26dbm_d%3DAKAmf-Cr58V-PzhMZIqX2ReI3zxL7Pl5poWQw0mmDOoiLywHVbzvBSX3J55oPH8yi9G3Q1SNleCbFi_IPOpvqJymp6BZ59rq4CevDppWjo6Lqs_qSm_qgRavrT5pCo2IWPtp0AFm0WoEvngbQx3wJhF9KodzMlcd5FxfxToljRzWFvpe9Zvbjk7sT53kTU1I43zhmPJslP9bit9eNtdeAUz_FWCiV3rl3puoImSG721KxpJT-v284r_bxlH0vIqju29mJqv4n6DFsJuv6zEittlB2S4LiQF2NGqme97A2UbPazvVVU0qFfadz9q2z8NkI6bXwcCp70G5YdCKGTpqexuJ9S_306T00rIdXlX_QIi68aUoSvQ_eOOm-fC0l3Jrv1fj8_tBgq1WUiKRdrrl95WSavMwsqSmMa8batE-UVT8ng4mGSGyVh7ghsUC4XtZVFfVfjltDLQmiDR3O4lmskygP16NCX4VkQfypXfKuIy0prXqbv81oY-52v_OrSX1_gFTKARIl2FjkT-BXeTDLHMuga5BebbWltCbZS5OJ7tqIszI_UPxg7s5GMjbkb3dqoi2UzJcIY1-MEQUGbF2_Pe_XS2c5ov_ag%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8661801246743&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=46944100097592304445002012515012&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: B2A2D183:B7EE_91EFC182:01BB_655CC620_67C5AEB:1E878

GET
H2 200 / Show response
adv.office-partner.de/ Frame 378E 930 B
922 B 9ms
9ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=ce9175309d&subid=&uid=fe93a7cbb3fa11fa&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC9T6tH8ZcZdPYCprQ3gO2j73gCqblvaBpnZecp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QkIZhE2p7XLyiVKLbmGL8ydYRIitA2ZqUa2a8_cvmCE9Yw4V5Z0lLIZg091lx_TOYBa6rUEtKtNRkCXTUXtDDfBjnM8i4llldyhFQbp_q8EIohZzhvQok8tmW6UI8KW04locBL5r5T15mOxqZ-1tLNJgoaIlCcj3vSbirSN3B2jooLfAC3Gry5arDzu5yZaahBftT1_9NM4shAiubxyOMnB-36mih7zCAdDTGWL9schcbU8v14pbKw9FtahcNMXsr165qVXrXkOKDhGEdEPD9U-NiQSYXnb5o-3T6pWX8QEE04T6cMP_AsGTaLHa30ate6Dbbah4Fs5FKAgL9-bxfg3or94WroABv2AGtc0Vc9gnz4_NcwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCI2c4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_05ZeteFSShquxyRIki0PwrS3hvNA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AjzsKfxkAg4dUBEKH_mphaOc8qw19KYmLWSITAF4EFWszUDR8b2CW1CIbVBzy0-wtFBg2Qc5UoVI95yG-yeoXV5s3fZni_9PfXHjutY5UgZdG8_rmvdrfEJW6Lddw7J8OHBgrmabErSL0YmecJGqoBAGvhychU-zXqjscBVT3EmiLBJrs%26cry%3D1%26dbm_d%3DAKAmf-Cr58V-PzhMZIqX2ReI3zxL7Pl5poWQw0mmDOoiLywHVbzvBSX3J55oPH8yi9G3Q1SNleCbFi_IPOpvqJymp6BZ59rq4CevDppWjo6Lqs_qSm_qgRavrT5pCo2IWPtp0AFm0WoEvngbQx3wJhF9KodzMlcd5FxfxToljRzWFvpe9Zvbjk7sT53kTU1I43zhmPJslP9bit9eNtdeAUz_FWCiV3rl3puoImSG721KxpJT-v284r_bxlH0vIqju29mJqv4n6DFsJuv6zEittlB2S4LiQF2NGqme97A2UbPazvVVU0qFfadz9q2z8NkI6bXwcCp70G5YdCKGTpqexuJ9S_306T00rIdXlX_QIi68aUoSvQ_eOOm-fC0l3Jrv1fj8_tBgq1WUiKRdrrl95WSavMwsqSmMa8batE-UVT8ng4mGSGyVh7ghsUC4XtZVFfVfjltDLQmiDR3O4lmskygP16NCX4VkQfypXfKuIy0prXqbv81oY-52v_OrSX1_gFTKARIl2FjkT-BXeTDLHMuga5BebbWltCbZS5OJ7tqIszI_UPxg7s5GMjbkb3dqoi2UzJcIY1-MEQUGbF2_Pe_XS2c5ov_ag%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8661801246743&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 046F 2 KB
2 KB 134ms
71ms Script
text/html 13.42.237.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=46944100097592304445002012515012&nw=1
Requested by: Host: support.foxwebapps.com
URL: http://support.foxwebapps.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.237.35 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-237-35.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 3fa5b706edb7eccc65e5e66d78c6933aac60326c1bb75e9205a751f4b454b8f5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
last-modified: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:48 GMT

GET
H2

200

activityi;dc_pre=CJXHxvGt1YIDFf3JOwIdejYLNQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2763731931304.7114 Show response
5994599.fls.doubleclick.net/ Frame 9E3D
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2763731931304.7114?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CJXHxvGt1YIDFf3JOwIdejYLNQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2763731931304.7114?

392 B
328 B

57ms
56ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CJXHxvGt1YIDFf3JOwIdejYLNQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2763731931304.7114?

Requested by

Host: support.foxwebapps.com
URL: http://support.foxwebapps.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e4f9cef7ef6029cfc315d5dc9bc6f46975787c116deb6e50d4df1d82b9f1a1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 219
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Tue, 21 Nov 2023 15:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJXHxvGt1YIDFf3JOwIdejYLNQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2763731931304.7114?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900012.redintelligence.net/ Frame A06F 7 KB
2 KB 43ms
15ms Document
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/request_content.php?s=46944100097592304445002012515012&a=d7c67e4e
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request.php?zone=5zyrr3xpcfb3&nw=20&renderingType=javascript&namespace=ce9175309d&subid=&uid=fe93a7cbb3fa11fa&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC9T6tH8ZcZdPYCprQ3gO2j73gCqblvaBpnZecp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSWAk_QkIZhE2p7XLyiVKLbmGL8ydYRIitA2ZqUa2a8_cvmCE9Yw4V5Z0lLIZg091lx_TOYBa6rUEtKtNRkCXTUXtDDfBjnM8i4llldyhFQbp_q8EIohZzhvQok8tmW6UI8KW04locBL5r5T15mOxqZ-1tLNJgoaIlCcj3vSbirSN3B2jooLfAC3Gry5arDzu5yZaahBftT1_9NM4shAiubxyOMnB-36mih7zCAdDTGWL9schcbU8v14pbKw9FtahcNMXsr165qVXrXkOKDhGEdEPD9U-NiQSYXnb5o-3T6pWX8QEE04T6cMP_AsGTaLHa30ate6Dbbah4Fs5FKAgL9-bxfg3or94WroABv2AGtc0Vc9gnz4_NcwATrj_yO9wPgBAOIBe-vlog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCBYIgOGAEBABGB0yAqoCOgKAQEi9_cE6gAoDmAsByAsBgAwBogwQKg4KDOS0sQLutbECtbixAqoNAkRF4g0TCI2c4vCt1YIDFRqodwodtkcPrLATh--xFdATANgTA4gUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_05ZeteFSShquxyRIki0PwrS3hvNA%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-AjzsKfxkAg4dUBEKH_mphaOc8qw19KYmLWSITAF4EFWszUDR8b2CW1CIbVBzy0-wtFBg2Qc5UoVI95yG-yeoXV5s3fZni_9PfXHjutY5UgZdG8_rmvdrfEJW6Lddw7J8OHBgrmabErSL0YmecJGqoBAGvhychU-zXqjscBVT3EmiLBJrs%26cry%3D1%26dbm_d%3DAKAmf-Cr58V-PzhMZIqX2ReI3zxL7Pl5poWQw0mmDOoiLywHVbzvBSX3J55oPH8yi9G3Q1SNleCbFi_IPOpvqJymp6BZ59rq4CevDppWjo6Lqs_qSm_qgRavrT5pCo2IWPtp0AFm0WoEvngbQx3wJhF9KodzMlcd5FxfxToljRzWFvpe9Zvbjk7sT53kTU1I43zhmPJslP9bit9eNtdeAUz_FWCiV3rl3puoImSG721KxpJT-v284r_bxlH0vIqju29mJqv4n6DFsJuv6zEittlB2S4LiQF2NGqme97A2UbPazvVVU0qFfadz9q2z8NkI6bXwcCp70G5YdCKGTpqexuJ9S_306T00rIdXlX_QIi68aUoSvQ_eOOm-fC0l3Jrv1fj8_tBgq1WUiKRdrrl95WSavMwsqSmMa8batE-UVT8ng4mGSGyVh7ghsUC4XtZVFfVfjltDLQmiDR3O4lmskygP16NCX4VkQfypXfKuIy0prXqbv81oY-52v_OrSX1_gFTKARIl2FjkT-BXeTDLHMuga5BebbWltCbZS5OJ7tqIszI_UPxg7s5GMjbkb3dqoi2UzJcIY1-MEQUGbF2_Pe_XS2c5ov_ag%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=8661801246743&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: 524d19bae7f093e3f2eb590b4d92fc867f5068963aa51473ec8e78e78096fb62

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2088
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:48 GMT
Expires: Tue, 21 Nov 2023 15:00:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 046F
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=46944100097592304445002012515012&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=46944100097592304445002012515012&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
666 B

93ms
44ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=46944100097592304445002012515012&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B7EE_91EFC182:01BB_655CC620_67C5AEF:1E878
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=46944100097592304445002012515012&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 046F 43 B
704 B 304ms
277ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=46944100097592304445002012515012&pv=1

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:49 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 3D5D
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=38667000106723804444994012515004&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=38667000106723804444994012515004&actionid=879111&produktid=ratenkredit&dt_url=

0
200 B

51ms
43ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=38667000106723804444994012515004&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=07f52c37d3&subid=&uid=9ca731d48ba03963&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC81myH8ZcZc_YCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Q5mmL3z1eJRKAkLB0_auPH_R1UgFap8aQliArGDGeOkyr2mAdcxDxAhaXdZMtzEm4wLscdfDXVcGikqg_tBYsGOhSdco-t0uJOl0cozzl5vne9javx_XJMhTu8u9KXW5ldAaOFezK1CEYzFXOM90XagtICLiY8I2w6TmXmijPqulrar-DVH7m4gp4J0UBzXk2pUl7uAvBIH-keTyrG8alsqIYD-jfIeTqwyrogZ1R36dR76f7KQzMXcSZ8LXXEesnRmXKtXfItKrd4ZOhiunPctchPoVwRazQyVokhueDprbuSdkEiyjX8HU_9GC47WwmQ8put1i2K3dDVqgNX-WTwY2XZuv8sB96x9_3RozgGr_LPfDM-MAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiKnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_21vMgWGYJxCqPD1CH1huYXwwu9ow%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-C7YV7l8TsIyQxd2XRw5bYpW-vp4AOZtakUs7tGnZrKd1y05hAG6dB8gUFS-ZFzp5x3teUb7DYu1TSY3JYPWU-fSdc6iQEx9CrYY5A0agOI8FB7a9_BRGY7qm7uGTmyLgCEJDY8eDcGFLXizdZ7zV5gnUkeAhDGMBQl6KNWaBDpibM7r24%26cry%3D1%26dbm_d%3DAKAmf-AclDEOII1BP_t-yb5Tts0MEQZsekYxBgauZCHVOtuLbVy8O6bv9Nev6CyqGy88m0nEM8wu7YuXokUiS7IfLgAZoUBr6FG-dBXfjRoqOxjJD-HWO2pDddAQVjcuzGH7hT3WUWKTZdOwXbvxD7beW1mnubCGFVSfw-C7pUdOqCFMB1VZOsi07uho2zHgU5MnRPUA5BPXqFY06Ezj0-zI52KWiySh2PPrhjvXZgyBX6Kd2FwTDAprbvZsjC3ReJSJF3os7ketl8lBoqxUzaNVyZ9LumeVlTUOPh97TygerH6GMO8MyiietNmbfu6ji-GBxpZO-ycmrHflKJO_DV9kS6dMYbJlCpXpVB-_JBQCrsGJYuxchvC969wsS21K12u953tvsZDxLOCtYyyH0ESCjnfmzaBP7D3rnCZGJUNJ7jvuTBo_lxdh88qJ25q1HYg6v8fCG4eNkJjRFXFtF7E7gAG53T8bU6TUPRK830Mc_AqzXpIkQKFBbDfZdXQqJZfzLVSNEOZbtyrpRtDW1o3uf7hmKbRyf4yT_7jkHTH0JvqzX9jIXFC2ZMVsYLLcoXvuff_axWwH-9k4FiRb1OB_1zHSt6wmrw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3601819351280&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=38667000106723804444994012515004&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: B2A2D183:B7F8_91EFC182:01BB_655CC620_67CBFEE:1E87A

GET
H2 200 / Show response
adv.office-partner.de/ Frame BF6C 930 B
922 B 12ms
11ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=07f52c37d3&subid=&uid=9ca731d48ba03963&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC81myH8ZcZc_YCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Q5mmL3z1eJRKAkLB0_auPH_R1UgFap8aQliArGDGeOkyr2mAdcxDxAhaXdZMtzEm4wLscdfDXVcGikqg_tBYsGOhSdco-t0uJOl0cozzl5vne9javx_XJMhTu8u9KXW5ldAaOFezK1CEYzFXOM90XagtICLiY8I2w6TmXmijPqulrar-DVH7m4gp4J0UBzXk2pUl7uAvBIH-keTyrG8alsqIYD-jfIeTqwyrogZ1R36dR76f7KQzMXcSZ8LXXEesnRmXKtXfItKrd4ZOhiunPctchPoVwRazQyVokhueDprbuSdkEiyjX8HU_9GC47WwmQ8put1i2K3dDVqgNX-WTwY2XZuv8sB96x9_3RozgGr_LPfDM-MAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiKnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_21vMgWGYJxCqPD1CH1huYXwwu9ow%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-C7YV7l8TsIyQxd2XRw5bYpW-vp4AOZtakUs7tGnZrKd1y05hAG6dB8gUFS-ZFzp5x3teUb7DYu1TSY3JYPWU-fSdc6iQEx9CrYY5A0agOI8FB7a9_BRGY7qm7uGTmyLgCEJDY8eDcGFLXizdZ7zV5gnUkeAhDGMBQl6KNWaBDpibM7r24%26cry%3D1%26dbm_d%3DAKAmf-AclDEOII1BP_t-yb5Tts0MEQZsekYxBgauZCHVOtuLbVy8O6bv9Nev6CyqGy88m0nEM8wu7YuXokUiS7IfLgAZoUBr6FG-dBXfjRoqOxjJD-HWO2pDddAQVjcuzGH7hT3WUWKTZdOwXbvxD7beW1mnubCGFVSfw-C7pUdOqCFMB1VZOsi07uho2zHgU5MnRPUA5BPXqFY06Ezj0-zI52KWiySh2PPrhjvXZgyBX6Kd2FwTDAprbvZsjC3ReJSJF3os7ketl8lBoqxUzaNVyZ9LumeVlTUOPh97TygerH6GMO8MyiietNmbfu6ji-GBxpZO-ycmrHflKJO_DV9kS6dMYbJlCpXpVB-_JBQCrsGJYuxchvC969wsS21K12u953tvsZDxLOCtYyyH0ESCjnfmzaBP7D3rnCZGJUNJ7jvuTBo_lxdh88qJ25q1HYg6v8fCG4eNkJjRFXFtF7E7gAG53T8bU6TUPRK830Mc_AqzXpIkQKFBbDfZdXQqJZfzLVSNEOZbtyrpRtDW1o3uf7hmKbRyf4yT_7jkHTH0JvqzX9jIXFC2ZMVsYLLcoXvuff_axWwH-9k4FiRb1OB_1zHSt6wmrw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3601819351280&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2 200 link.html Show response
track.webgains.com/ Frame 5142 2 KB
2 KB 127ms
85ms Script
text/html 13.42.237.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=38667000106723804444994012515004&nw=1
Requested by: Host: support.foxwebapps.com
URL: http://support.foxwebapps.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.237.35 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-237-35.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 49a87f074a81b0f5576d633522ed8d81ac56a72335506ee9ec288da25bfc31b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
last-modified: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:48 GMT

GET
H2

200

activityi;dc_pre=CI_UxvGt1YIDFRXJOwIddqoOMw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9194020451682.91 Show response
5994599.fls.doubleclick.net/ Frame 0F6D
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9194020451682.91?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CI_UxvGt1YIDFRXJOwIddqoOMw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9194020451682.91?

390 B
286 B

59ms
58ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CI_UxvGt1YIDFRXJOwIddqoOMw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9194020451682.91?

Requested by

Host: support.foxwebapps.com
URL: http://support.foxwebapps.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c604ad540ceab1bbba119738172c63aaf81cb8dbcd3ccae636e9fd0b1550bb4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Tue, 21 Nov 2023 15:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CI_UxvGt1YIDFRXJOwIddqoOMw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9194020451682.91?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90004.redintelligence.net/ Frame FA48 7 KB
2 KB 39ms
13ms Document
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request_content.php?s=38667000106723804444994012515004&a=bac1a83a
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=wmoiqux43uzw&nw=20&renderingType=javascript&namespace=07f52c37d3&subid=&uid=9ca731d48ba03963&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=336x280&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC81myH8ZcZc_YCprQ3gO2j73gCqblvaBpvZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSXAk_Q5mmL3z1eJRKAkLB0_auPH_R1UgFap8aQliArGDGeOkyr2mAdcxDxAhaXdZMtzEm4wLscdfDXVcGikqg_tBYsGOhSdco-t0uJOl0cozzl5vne9javx_XJMhTu8u9KXW5ldAaOFezK1CEYzFXOM90XagtICLiY8I2w6TmXmijPqulrar-DVH7m4gp4J0UBzXk2pUl7uAvBIH-keTyrG8alsqIYD-jfIeTqwyrogZ1R36dR76f7KQzMXcSZ8LXXEesnRmXKtXfItKrd4ZOhiunPctchPoVwRazQyVokhueDprbuSdkEiyjX8HU_9GC47WwmQ8put1i2K3dDVqgNX-WTwY2XZuv8sB96x9_3RozgGr_LPfDM-MAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiKnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_21vMgWGYJxCqPD1CH1huYXwwu9ow%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-C7YV7l8TsIyQxd2XRw5bYpW-vp4AOZtakUs7tGnZrKd1y05hAG6dB8gUFS-ZFzp5x3teUb7DYu1TSY3JYPWU-fSdc6iQEx9CrYY5A0agOI8FB7a9_BRGY7qm7uGTmyLgCEJDY8eDcGFLXizdZ7zV5gnUkeAhDGMBQl6KNWaBDpibM7r24%26cry%3D1%26dbm_d%3DAKAmf-AclDEOII1BP_t-yb5Tts0MEQZsekYxBgauZCHVOtuLbVy8O6bv9Nev6CyqGy88m0nEM8wu7YuXokUiS7IfLgAZoUBr6FG-dBXfjRoqOxjJD-HWO2pDddAQVjcuzGH7hT3WUWKTZdOwXbvxD7beW1mnubCGFVSfw-C7pUdOqCFMB1VZOsi07uho2zHgU5MnRPUA5BPXqFY06Ezj0-zI52KWiySh2PPrhjvXZgyBX6Kd2FwTDAprbvZsjC3ReJSJF3os7ketl8lBoqxUzaNVyZ9LumeVlTUOPh97TygerH6GMO8MyiietNmbfu6ji-GBxpZO-ycmrHflKJO_DV9kS6dMYbJlCpXpVB-_JBQCrsGJYuxchvC969wsS21K12u953tvsZDxLOCtYyyH0ESCjnfmzaBP7D3rnCZGJUNJ7jvuTBo_lxdh88qJ25q1HYg6v8fCG4eNkJjRFXFtF7E7gAG53T8bU6TUPRK830Mc_AqzXpIkQKFBbDfZdXQqJZfzLVSNEOZbtyrpRtDW1o3uf7hmKbRyf4yT_7jkHTH0JvqzX9jIXFC2ZMVsYLLcoXvuff_axWwH-9k4FiRb1OB_1zHSt6wmrw%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=3601819351280&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9482f46a1aa93bbd2badefda2b93254e253f581de4a0210c94d834ff1c09b3f8

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2120
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:48 GMT
Expires: Tue, 21 Nov 2023 15:00:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame 5142
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=38667000106723804444994012515004&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=38667000106723804444994012515004&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
666 B

111ms
49ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=38667000106723804444994012515004&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B7F8_91EFC182:01BB_655CC620_67CBFF3:1E87A
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=38667000106723804444994012515004&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 5142 43 B
704 B 88ms
65ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=38667000106723804444994012515004&pv=1

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 115ms
115ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eMi14T5iA26nJpBY2Ob%2FR%2BeN63r9IeqrA29ab%2BVcHQ2z7yqbegCw89ePAC%2BEah1vUCJ6xRqkQSUsYvM5xj9m4y7zK3DsF3R47Lgvt7N8lNDo85mpjo3Qw9fm%2BjQWagcGGwiIFD43gPOBj2kvOLM%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cded488b2c41-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 113ms
112ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdec9fbc2c41-FRA
date: Tue, 21 Nov 2023 15:00:48 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jPz5LMFumExYrXIu%2FmclzyuoOZcyEh2vLHNs33p%2BoU1zETnnel2icMzhslKQdyhhXzYc02ycY7lVE9e%2F1uWUrzEdhl5KqJmzTrR3lEcznqfDMkXiKOUrk%2FTHxzWmuXQxiQMVqCqJIO%2B4W2etq8s%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5749 1 KB
643 B 19ms
19ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62635
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 046F 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4ad4f9da0510682a1e5a60ca5ed9e8a566dbb9b4c756f189bd141cc967e8893f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 746A 1 KB
643 B 14ms
14ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62635
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 5142 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a720742962525308088b764af0203c5b77a3defb938113d4e864b70ad8b90222

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame A06F 5 KB
682 B 24ms
23ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=46944100097592304445002012515012&a=d7c67e4e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:38:15 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame A06F 17 KB
17 KB 38ms
14ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=46944100097592304445002012515012&a=d7c67e4e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b4b239eba09e8485750d875f6896c5d3dd964b2d2527c147c0fa783ae46465a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame A06F 16 KB
16 KB 38ms
13ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=46944100097592304445002012515012&a=d7c67e4e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 59f31498d281202c276e09a063b5fcfb75c8b4c983bd8637a5acaa0db90dd68f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame A06F 14 KB
14 KB 41ms
15ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/image-1200x627.jpg
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=46944100097592304445002012515012&a=d7c67e4e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 518231e0e2e73091807e2a20453c25f3d4420287c335402a9ce28bb972e8c31e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13920
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame FA48 5 KB
682 B 27ms
26ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=38667000106723804444994012515004&a=bac1a83a

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:38:44 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame FA48 17 KB
17 KB 42ms
14ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=38667000106723804444994012515004&a=bac1a83a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b4b239eba09e8485750d875f6896c5d3dd964b2d2527c147c0fa783ae46465a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame FA48 16 KB
16 KB 41ms
13ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=38667000106723804444994012515004&a=bac1a83a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 59f31498d281202c276e09a063b5fcfb75c8b4c983bd8637a5acaa0db90dd68f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame FA48 14 KB
14 KB 40ms
13ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/image-1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=38667000106723804444994012515004&a=bac1a83a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 518231e0e2e73091807e2a20453c25f3d4420287c335402a9ce28bb972e8c31e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13920
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 561D 174 KB
62 KB 30ms
26ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b2b4cc52536e20695a5e3d40666465d174f2323db405dc959bdf5575de67146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63903
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame E691 174 KB
62 KB 36ms
35ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b2b4cc52536e20695a5e3d40666465d174f2323db405dc959bdf5575de67146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63903
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 378E 174 KB
62 KB 50ms
49ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f98400a66245e9eaebdd549a654c1170a65fb41088dfa207b9b8b29370aa6fdc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63901
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame BF6C 174 KB
62 KB 34ms
33ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5f766a1d1dd167cc34c4f6d53215615bb6424900d0cf3a92c5c93e829c699218

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63925
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:48 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 171A
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=42777500112678604444990012515010&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=42777500112678604444990012515010&actionid=879111&produktid=ratenkredit&dt_url=

0
36 B

26ms
26ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=42777500112678604444990012515010&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=43c836ad73&subid=&uid=29dc9b13adf63ff7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4MLoH8ZcZc3YCprQ3gO2j73gCqblvaBplZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSUAk_QUkPDJc52dBdoQ4mVD6E6sV4qDJf1ivJvcIc-7nw-gk-EWa-VqLJj7Sryb1KcVFDwdI5qkYcjjQZ2AbHMg5y0UK3bVj--NnA4puN1pU6_q3-rsYIJ8ZbIM3Gu1nht63Spebuu3GE6sb7KHfp_eii0CcIs19m5ccfopei1uMDYtIJp9mO54JfNmx9jqHLPH1Vcy_Zhw_twacJ9UUAHJi6zae8UNwHqixGZIj9OhM-iRPUXJ7-o2PXYF2HK8X_1BvKO89W-illyGMRSs1CxRfmrDZla6jWvUlUrJAvKEPLfv0IhufJRD6a46H7JHgRK55awTLBbp0P5zd1tQ1s7wqJuGA9VzS_xHU8DvL5nKT0yRD0DlMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiJnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2nY99TnNIPnKAuuVrjl7UWnuLE4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BFgxdEPMjEh5FGasfFRYBLMuPAKz1XYJ6l9HMunyypBtnyoUn2nZQ3sej2z2xVKGfRbQefhyL6tmoUBARmWqpAYPY0e53xC7K_aYVBT-R8Dk0VDzcVfzw2KyfHaabi72x-l2WY4iZ8XyNl8do1NHje1XN4yPb-_eZlA_i_ax_Ln7QUHZ8%26cry%3D1%26dbm_d%3DAKAmf-DPrigxJGOWiVqdTU7Vsxsl_aYK8-yxXqB_aqxl02R39s_uq5fcFkzFafh1PnftBLA6qP4s6nGDcm5VXvCipflWe6eCWN_7cwjwa8OM2QjwqLPYpgPUhaZSiATMA9ZR8i1zyViZiEw_sHY6tLsYLvxiqi8N11umd33w48vpqxlIOhVcl09odct7ZRpOMWzJscnhxeeyi3yrwo7wt1u5JW_D1vzhc14QwPu2945y3qtcUIiDiq7svOvG1PChRVsfsFug_IaAlV9tm6hX3VdlKQCG-eYt_nLT7s7SOAGJyD6Y0fkopgupK6rT_1Aml1tgSnEC6H_SfDPq3n4tyivtjMhZaCNY6TnfnSvPzNsTDmE_t1DlAKzhHlPXz6Ja4E7dvfwrQz3x8sIxSl8kqJkcjaFt4T2jB-XCDRxVDgD_yCRG6y9TQtgnUEUKCp4GA-6Y3NnrQKVqm5P2RXXLlbMGvySsMWDRvBl1rXgtw_xr4V2g8yGwHOIwGcECnCdoKMTWuHnP9mVQVgc73U8qbU_VJEZ7h-NaHfyshXdmLAd6DKCOIrNS8mrHeabT0XDhbfkJUMVLdOIrzyPokXTA_vwSGQWOQ4fckg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6440066283224&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

85-10-231-200.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Tue, 21 Nov 2023 15:00:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=42777500112678604444990012515010&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: B2A2D183:B7EE_91EFC182:01BB_655CC620_67C5AF4:1E878

GET
H2 200 / Show response
adv.office-partner.de/ Frame D8CC 930 B
922 B 21ms
6ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=43c836ad73&subid=&uid=29dc9b13adf63ff7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4MLoH8ZcZc3YCprQ3gO2j73gCqblvaBplZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSUAk_QUkPDJc52dBdoQ4mVD6E6sV4qDJf1ivJvcIc-7nw-gk-EWa-VqLJj7Sryb1KcVFDwdI5qkYcjjQZ2AbHMg5y0UK3bVj--NnA4puN1pU6_q3-rsYIJ8ZbIM3Gu1nht63Spebuu3GE6sb7KHfp_eii0CcIs19m5ccfopei1uMDYtIJp9mO54JfNmx9jqHLPH1Vcy_Zhw_twacJ9UUAHJi6zae8UNwHqixGZIj9OhM-iRPUXJ7-o2PXYF2HK8X_1BvKO89W-illyGMRSs1CxRfmrDZla6jWvUlUrJAvKEPLfv0IhufJRD6a46H7JHgRK55awTLBbp0P5zd1tQ1s7wqJuGA9VzS_xHU8DvL5nKT0yRD0DlMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiJnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2nY99TnNIPnKAuuVrjl7UWnuLE4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BFgxdEPMjEh5FGasfFRYBLMuPAKz1XYJ6l9HMunyypBtnyoUn2nZQ3sej2z2xVKGfRbQefhyL6tmoUBARmWqpAYPY0e53xC7K_aYVBT-R8Dk0VDzcVfzw2KyfHaabi72x-l2WY4iZ8XyNl8do1NHje1XN4yPb-_eZlA_i_ax_Ln7QUHZ8%26cry%3D1%26dbm_d%3DAKAmf-DPrigxJGOWiVqdTU7Vsxsl_aYK8-yxXqB_aqxl02R39s_uq5fcFkzFafh1PnftBLA6qP4s6nGDcm5VXvCipflWe6eCWN_7cwjwa8OM2QjwqLPYpgPUhaZSiATMA9ZR8i1zyViZiEw_sHY6tLsYLvxiqi8N11umd33w48vpqxlIOhVcl09odct7ZRpOMWzJscnhxeeyi3yrwo7wt1u5JW_D1vzhc14QwPu2945y3qtcUIiDiq7svOvG1PChRVsfsFug_IaAlV9tm6hX3VdlKQCG-eYt_nLT7s7SOAGJyD6Y0fkopgupK6rT_1Aml1tgSnEC6H_SfDPq3n4tyivtjMhZaCNY6TnfnSvPzNsTDmE_t1DlAKzhHlPXz6Ja4E7dvfwrQz3x8sIxSl8kqJkcjaFt4T2jB-XCDRxVDgD_yCRG6y9TQtgnUEUKCp4GA-6Y3NnrQKVqm5P2RXXLlbMGvySsMWDRvBl1rXgtw_xr4V2g8yGwHOIwGcECnCdoKMTWuHnP9mVQVgc73U8qbU_VJEZ7h-NaHfyshXdmLAd6DKCOIrNS8mrHeabT0XDhbfkJUMVLdOIrzyPokXTA_vwSGQWOQ4fckg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6440066283224&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Tue, 21 Nov 2023 15:00:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Tue, 28 Nov 2023 15:00:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H/1.1

200
OK

view.aspx Show response
www.media01.eu/ Frame C798
Redirect Chain

https://www.awin1.com/cshow.php?s=2840007&v=20646&q=409071&r=296283&pref1=42777500112678604444990012515010&pv=1
https://www.media01.eu/view.aspx?trackid=4FFE2293E3AB03641C3925C92FA06F0B&dt_subid1=&dt_subid2=affiliate&dt_keywords=&dt_freetext=&awc=20646_296283_1700578848_c1885be0-887e-11ee-92fe-22394270969d&d...

0
904 B

63ms
22ms

Document
text/html

85.10.231.200
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.media01.eu/view.aspx?trackid=4FFE2293E3AB03641C3925C92FA06F0B&dt_subid1=&dt_subid2=affiliate&dt_keywords=&dt_freetext=&awc=20646_296283_1700578848_c1885be0-887e-11ee-92fe-22394270969d&dt_mode=iframe&dt_url=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

85.10.231.200 Fellbach, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Tue, 21 Nov 2023 04:00:48 GMT
p3p: policyref="http://www.media01.eu/www.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 0
Date: Tue, 21 Nov 2023 15:00:48 GMT
Location: https://www.media01.eu/view.aspx?trackid=4FFE2293E3AB03641C3925C92FA06F0B&dt_subid1=&dt_subid2=affiliate&dt_keywords=&dt_freetext=&awc=20646_296283_1700578848_c1885be0-887e-11ee-92fe-22394270969d&dt_mode=iframe&dt_url=
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Strict-Transport-Security: max-age=86400

GET
H2 200 link.html Show response
track.webgains.com/ Frame DCC3 2 KB
2 KB 80ms
66ms Script
text/html 13.42.237.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=42777500112678604444990012515010&nw=1
Requested by: Host: support.foxwebapps.com
URL: http://support.foxwebapps.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.237.35 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-237-35.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 0831d85065c932c90164153c66281c16856d14e2edd27380abdcea370ec9259c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
last-modified: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:48 GMT

GET
H3

200

activityi;dc_pre=CM3Oz_Gt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2863597191231.755 Show response
5994599.fls.doubleclick.net/ Frame DFB4
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2863597191231.755?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CM3Oz_Gt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2863597191231.755?

391 B
240 B

70ms
69ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CM3Oz_Gt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2863597191231.755?

Requested by

Host: support.foxwebapps.com
URL: http://support.foxwebapps.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

76684671c40c1e927c510a03838c70731d6f1a437f7010797d222bec54188b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Tue, 21 Nov 2023 15:00:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:48 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CM3Oz_Gt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2863597191231.755?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900010.redintelligence.net/ Frame 58C7 7 KB
3 KB 39ms
14ms Document
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request.php?zone=vjdy8w6hewcq&nw=20&renderingType=javascript&namespace=43c836ad73&subid=&uid=29dc9b13adf63ff7&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC4MLoH8ZcZc3YCprQ3gO2j73gCqblvaBplZOcp8kP8C4QASCG94YmYJXipoKwB8gBCakCprgQDx5csj6oAwHIA5sEqgSUAk_QUkPDJc52dBdoQ4mVD6E6sV4qDJf1ivJvcIc-7nw-gk-EWa-VqLJj7Sryb1KcVFDwdI5qkYcjjQZ2AbHMg5y0UK3bVj--NnA4puN1pU6_q3-rsYIJ8ZbIM3Gu1nht63Spebuu3GE6sb7KHfp_eii0CcIs19m5ccfopei1uMDYtIJp9mO54JfNmx9jqHLPH1Vcy_Zhw_twacJ9UUAHJi6zae8UNwHqixGZIj9OhM-iRPUXJ7-o2PXYF2HK8X_1BvKO89W-illyGMRSs1CxRfmrDZla6jWvUlUrJAvKEPLfv0IhufJRD6a46H7JHgRK55awTLBbp0P5zd1tQ1s7wqJuGA9VzS_xHU8DvL5nKT0yRD0DlMAE64_8jvcD4AQDiAXvr5aIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggWCIDhgBAQARgdMgKqAjoCgEBIvf3BOoAKA5gLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJEReINEwiJnOLwrdWCAxUaqHcKHbZHD6ywE4fvsRXQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB%26sig%3DAOD64_2nY99TnNIPnKAuuVrjl7UWnuLE4w%26client%3Dca-pub-1062972861553303%26dbm_c%3DAKAmf-BFgxdEPMjEh5FGasfFRYBLMuPAKz1XYJ6l9HMunyypBtnyoUn2nZQ3sej2z2xVKGfRbQefhyL6tmoUBARmWqpAYPY0e53xC7K_aYVBT-R8Dk0VDzcVfzw2KyfHaabi72x-l2WY4iZ8XyNl8do1NHje1XN4yPb-_eZlA_i_ax_Ln7QUHZ8%26cry%3D1%26dbm_d%3DAKAmf-DPrigxJGOWiVqdTU7Vsxsl_aYK8-yxXqB_aqxl02R39s_uq5fcFkzFafh1PnftBLA6qP4s6nGDcm5VXvCipflWe6eCWN_7cwjwa8OM2QjwqLPYpgPUhaZSiATMA9ZR8i1zyViZiEw_sHY6tLsYLvxiqi8N11umd33w48vpqxlIOhVcl09odct7ZRpOMWzJscnhxeeyi3yrwo7wt1u5JW_D1vzhc14QwPu2945y3qtcUIiDiq7svOvG1PChRVsfsFug_IaAlV9tm6hX3VdlKQCG-eYt_nLT7s7SOAGJyD6Y0fkopgupK6rT_1Aml1tgSnEC6H_SfDPq3n4tyivtjMhZaCNY6TnfnSvPzNsTDmE_t1DlAKzhHlPXz6Ja4E7dvfwrQz3x8sIxSl8kqJkcjaFt4T2jB-XCDRxVDgD_yCRG6y9TQtgnUEUKCp4GA-6Y3NnrQKVqm5P2RXXLlbMGvySsMWDRvBl1rXgtw_xr4V2g8yGwHOIwGcECnCdoKMTWuHnP9mVQVgc73U8qbU_VJEZ7h-NaHfyshXdmLAd6DKCOIrNS8mrHeabT0XDhbfkJUMVLdOIrzyPokXTA_vwSGQWOQ4fckg%26adurl%3D&documentReferer=https%3A%2F%2Fsimcast.com%2F&ancestorOrigins=https%3A%2F%2Fsimcast.com&random=6440066283224&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d57eda0488e186f73f72421547ee4bfc7ad869311dd271cd28f8802417d9aa84

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2240
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:48 GMT
Expires: Tue, 21 Nov 2023 15:00:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1

200
OK

e99aace94e6e5873881d3400993e1e7e
pv.medialead.de/trck/eview/ Frame DCC3
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=42777500112678604444990012515010&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=42777500112678604444990012515010&t=htlp&gdpr=1&consent=1&gdpr_consent=

43 B
666 B

45ms
44ms

Image
image/gif

145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=42777500112678604444990012515010&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800104416","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: B2A2D183:B7F8_91EFC182:01BB_655CC620_67CBFF8:1E87A
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

Redirect headers

location: https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=42777500112678604444990012515010&t=htlp&gdpr=1&consent=1&gdpr_consent=
date: Tue, 21 Nov 2023 15:00:48 GMT
server: nginx
content-length: 154
content-type: text/html

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame DCC3 43 B
704 B 88ms
85ms Image
image/gif 92.123.148.9
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=42777500112678604444990012515010&pv=1

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.148.9 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:48 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H2 200 dc_pre=CJXHxvGt1YIDFf3JOwIdejYLNQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2763731931304.7114
adservice.google.com/ddm/fls/z/ Frame 9E3D 42 B
107 B 93ms
54ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJXHxvGt1YIDFf3JOwIdejYLNQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2763731931304.7114

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CJXHxvGt1YIDFf3JOwIdejYLNQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2763731931304.7114?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CI_UxvGt1YIDFRXJOwIddqoOMw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9194020451682.91
adservice.google.com/ddm/fls/z/ Frame 0F6D 42 B
401 B 91ms
53ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CI_UxvGt1YIDFRXJOwIddqoOMw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9194020451682.91

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CI_UxvGt1YIDFRXJOwIddqoOMw;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=9194020451682.91?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1751 1 KB
643 B 15ms
14ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62636
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DCC3 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 48b7358d53b93adaeb8809b2c4b6ee2cc24a918c3586b90b84c9ca282a1fe455

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 113ms
113ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdee9b792c41-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rxl8QkGkTMAUt0g7vqduw46nSRTZQEBRnlda%2BrBBxSHKk%2Bx9hu2pXKMvXsngZCls4j90s6pqWpLT%2BdtqyhIw1vIeHcWS7DLig4%2Bv1udY4hMJ%2FtKCZmaYX54v4iZdeTHsm7eHHjD18%2FW%2BerFFnr0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

GET
H2 200 pwt.js Show response
ads.pubmatic.com/AdServer/js/pwt/161089/5500/ 212 KB
64 KB 29ms
7ms Script
application/javascript 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/pwt/161089/5500/pwt.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 4dcf78b31f69c1674cb5a75cd5fd5744538b50eaf34076396d9cf54acebee6e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: gzip
last-modified: Sat, 29 Apr 2023 00:43:34 GMT
server: Apache
vary: Accept-Encoding
content-type: application/javascript
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=68780
accept-ranges: bytes
content-length: 65407
expires: Wed, 22 Nov 2023 10:07:09 GMT

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 117ms
113ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2ueKUjHavdflQY%2F%2BCKYI73esOmdyre1DXNOsET35AEpUUAnX0qp%2BnaMeCoQRCcomXdJ4N0rUrTqFxzTLPsyVrYaXgGB6M5E6RnoXwSk3k8ubjZ0PVDfMqHN1hlg6nRTt3XZrTInyIxUsbGGfp5g%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdef5c572c41-FRA
content-length: 0

GET
H/1.1 200
OK user-sync Show response
sync.adkernel.com/ Frame F984 0
160 B 74ms
15ms Document
text/plain 77.245.57.72
WEBAIR-INTERNET-MTL

General

Check archive.org

Show headers Download Go to

Full URL: https://sync.adkernel.com/user-sync?zone=200527&r=https%3A%2F%2Fdemand.qortex.ai%2Fsync%3Fakuid%3Dhttps%3A%2F%2Fsimcast.com%7C%7BUID%7D
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 77.245.57.72 , United States, ASN36057 (WEBAIR-INTERNET-MTL, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Age: 0
Cache-Control: no-store
Connection: close
Content-Length: 0
Date: Tue, 21 Nov 2023 15:00:49 GMT
Pragma: no-cache
Server: nginx

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 109ms
109ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdeeab8f2c41-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CP5KtvuZbpFS5kGC47Lc2GNKFB%2Fk4YoSJLwQJYcIN%2Fi16bO4lqXk%2FSefYoglQ7T7PMh3mnO5JoTcRp%2BXQXuNKD1ofYqO7IxsjTB%2BaKA2XiF3JLOTHpQXVQkKFidEXuBTx31BrnH6ajFVfgQ2L24%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 113ms
111ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8uRtPNuidQRKTJyk0cZRzC8mUUCUctX8bfIYNXE7Ip5y1GruIyHOoAqnasK%2BjvGYwaVYcIkvX46jNaCwyoOLEP6E6c838tTKG%2F81l5XCGebdLW4V%2FTvADCOgV6Vu4DdufsH1FGEpschH9P9VU90%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdef5c5b2c41-FRA
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5749
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJtisjkLwiXaSE1nqXdYfO4&google_push=AXcoOmTuBjYE6HoajMX6XMdJOYtNYoIroCVtjY0Iz2iWFPlYz0xEOl0AtO...

170 B
188 B

27ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJtisjkLwiXaSE1nqXdYfO4&google_push=AXcoOmTuBjYE6HoajMX6XMdJOYtNYoIroCVtjY0Iz2iWFPlYz0xEOl0AtOvRPetN5ZMuGGTG9doY-KLoUzeWz14CFMDY9nvG_zOuDg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230116-FRA
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1700578849.178018,VS0,VE93
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJtisjkLwiXaSE1nqXdYfO4&google_push=AXcoOmTuBjYE6HoajMX6XMdJOYtNYoIroCVtjY0Iz2iWFPlYz0xEOl0AtOvRPetN5ZMuGGTG9doY-KLoUzeWz14CFMDY9nvG_zOuDg
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5749
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEPGWK7TozjHKPpO6BPbbE8g&google_cver=1&google_push=AXcoOmROsYIdcSktpFVt2kGYHFfoVWxwbc7_oeEcS6Ncfde8GEMtzTNUQ5ei5kxYAJKwgefiDVRB6mYH3B4zK8Rd4opbJeutAuYqbg
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmROsYIdcSktpFVt2kGYHFfoVWxwbc7_oeEcS6Ncfde8GEMtzTNUQ5ei5kxYAJKwgefiDVRB6mYH3B4zK8R...

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmROsYIdcSktpFVt2kGYHFfoVWxwbc7_oeEcS6Ncfde8GEMtzTNUQ5ei5kxYAJKwgefiDVRB6mYH3B4zK8Rd4opbJeutAuYqbg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmROsYIdcSktpFVt2kGYHFfoVWxwbc7_oeEcS6Ncfde8GEMtzTNUQ5ei5kxYAJKwgefiDVRB6mYH3B4zK8Rd4opbJeutAuYqbg
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 20 Nov 2023 15:00:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5749
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEH1KyNhqkkfiUJ32pT4g_ZM&google_cver=1&google_push=AXcoOmSEpXgUjRiA9cs_eSfhN43N-h-xZZTGs6Vp5To27YM2dSyMMH1TDQGoPvNrrWfK4Apt5rmDqyP1h2mXL2...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwMzkzMDU0MDcyNzIwMzk4Nw%3D%3D&google_push=AXcoOmSEpXgUjRiA9cs_eSfhN43N-h-xZZTGs6Vp5To27YM2dSyMMH1TDQGoPvNrrWfK4Apt5rmDqyP1h2mXL26Sl8...

170 B
188 B

24ms
24ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwMzkzMDU0MDcyNzIwMzk4Nw%3D%3D&google_push=AXcoOmSEpXgUjRiA9cs_eSfhN43N-h-xZZTGs6Vp5To27YM2dSyMMH1TDQGoPvNrrWfK4Apt5rmDqyP1h2mXL26Sl8I9ri96cF_NPg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwMzkzMDU0MDcyNzIwMzk4Nw%3D%3D&google_push=AXcoOmSEpXgUjRiA9cs_eSfhN43N-h-xZZTGs6Vp5To27YM2dSyMMH1TDQGoPvNrrWfK4Apt5rmDqyP1h2mXL26Sl8I9ri96cF_NPg
Date: Tue, 21 Nov 2023 15:00:49 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2 200 sync
x.bidswitch.net/ Frame 5749 43 B
146 B 186ms
9ms Image
image/gif 18.197.187.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPwn_qxEh1IJH9ZtqsfSVkY&google_cver=1&google_push=AXcoOmR9zv-iHPBPYPaPotQgdttqXCO8joy1wp5zKaGmXNN8JIIxKpdbtqDXV4PC7_Dv9awrwFGitihC8h2PSpSpUmjQ2aw5c3X_SQ
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.187.29 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-187-29.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5749
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESELYl9ZYuf7-ipVsk7EHd-XE&google_cver=1&google_push=AXcoOmTBs-KHfr3MOEIk7pA_2mqCJ07ZWhNYvukihvGRQ2T8xXa5KrrTNlKYHT2kow6CB-z1cf_0XXySkjaf_TL2g_sCSSy...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESELYl9ZYuf7-ipVsk7EHd-XE&google_cver=1&google_push=AXcoOmTBs-KHfr3MOEIk7pA_2mqCJ07ZWhNYvukihvGRQ2T8xXa5KrrTNlKYHT2kow6CB-z1cf_0XXySkjaf_TL2g_sCS...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTBs-KHfr3MOEIk7pA_2mqCJ07ZWhNYvukihvGRQ2T8xXa5KrrTNlKYHT2kow6CB-z1cf_0XXySkjaf_TL2g_sCSSyp-dIo

170 B
188 B

23ms
23ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTBs-KHfr3MOEIk7pA_2mqCJ07ZWhNYvukihvGRQ2T8xXa5KrrTNlKYHT2kow6CB-z1cf_0XXySkjaf_TL2g_sCSSyp-dIo

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AXcoOmTBs-KHfr3MOEIk7pA_2mqCJ07ZWhNYvukihvGRQ2T8xXa5KrrTNlKYHT2kow6CB-z1cf_0XXySkjaf_TL2g_sCSSyp-dIo
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5749
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESELVV44Q_ENoafnHT0F0XrPs&google_cver=1&google_push=AXcoOmTXU1Hak5hWYHPavD-VIYQEsfF3HPXM1jGLPm-mE_kgEmf_m0LLUnhC_38AKC9z4eeSNfL07E1c...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESELVV44Q_ENoafnHT0F0XrPs&google_cver=1&google_push=AXcoOmTXU1Hak5hWYHPavD-VIYQEsfF3HPXM1jGLPm-mE_kgEmf_m0LLUnhC_38AKC9z4eeSNfL...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQxMjE5NjE4MTk4MjIzNjQ5MQ&google_push=AXcoOmTXU1Hak5hWYHPavD-VIYQEsfF3HPXM1jGLPm-mE_kgEmf_m0LLUnhC_38AKC9z4eeSNfL07E...

170 B
188 B

30ms
29ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQxMjE5NjE4MTk4MjIzNjQ5MQ&google_push=AXcoOmTXU1Hak5hWYHPavD-VIYQEsfF3HPXM1jGLPm-mE_kgEmf_m0LLUnhC_38AKC9z4eeSNfL07E1cfzOPv-ty_-G6WIS9LuJh

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQxMjE5NjE4MTk4MjIzNjQ5MQ&google_push=AXcoOmTXU1Hak5hWYHPavD-VIYQEsfF3HPXM1jGLPm-mE_kgEmf_m0LLUnhC_38AKC9z4eeSNfL07E1cfzOPv-ty_-G6WIS9LuJh
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5749
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEANVmqoRdA9ccQPX5ZWHSjw&google_cver=1&google_push=AXcoOmRqr4BVRd-Lsfk4vB4asKhZ4Sttyss-Ovdk4qaLNIX_PA_xSiHDEK43-WLmpysqI1ND-NP...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FMVlotMjYtNEFNQw==&google_push=AXcoOmRqr4BVRd-Lsfk4vB4asKhZ4Sttyss-Ovdk4qaLNIX_PA_xSiHDEK43-WLmpysqI1ND-NPoIcXtd5F6y-6u5KbatmXgBXpg

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FMVlotMjYtNEFNQw==&google_push=AXcoOmRqr4BVRd-Lsfk4vB4asKhZ4Sttyss-Ovdk4qaLNIX_PA_xSiHDEK43-WLmpysqI1ND-NPoIcXtd5F6y-6u5KbatmXgBXpg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TFA4R1FMVlotMjYtNEFNQw==&google_push=AXcoOmRqr4BVRd-Lsfk4vB4asKhZ4Sttyss-Ovdk4qaLNIX_PA_xSiHDEK43-WLmpysqI1ND-NPoIcXtd5F6y-6u5KbatmXgBXpg
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: f5982f4f9cc79eb2b489dda8b92e3144
Expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5749 0
12 B 25ms
24ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I7A4Eli-u8YjaNIlQvbHbOMswEbRwCefDorrhpegfsuuZykbl3qsDPZ5FZ2jATgVpjAeW7

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 css
fonts.googleapis.com/ Frame 58C7 5 KB
682 B 34ms
26ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:21:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 58C7 64 KB
64 KB 40ms
15ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b72e953c176d582229175fe20f0dbabe25981999bdf63425ec1e9c797badded4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 58C7 57 KB
57 KB 41ms
13ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 107b8bf699b598435e3f199b40eede728c7d2586fecb6a651ab969dc9bdae8a9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 57893
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 58C7 47 KB
47 KB 43ms
14ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/1200x627.jpg
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 536eb24d8a78f1c0cf6f1cc8980259db5da37b2538d253bcea183afbac4429e0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 47874
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 58C7 71 KB
71 KB 43ms
14ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=240&height=150&url=https://cdn.contentspread.net/24i/advertiser/59568/creativesup/Laubblaeser_1200x627_BIS.jpg
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d8a3a5143be58c3ffd476757b268df004202c3b2d736aaee97b6b1eeedf6ccd1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: image/png

GET
H/1.1 200
OK viewability Show response
hal900012.redintelligence.net/ Frame A06F 0
150 B 44ms
13ms Script
text/html 94.130.102.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900012.redintelligence.net/viewability?s=46944100097592304445002012515012&a=26f6927a&vb=m
Requested by: Host: hal900012.redintelligence.net
URL: https://hal900012.redintelligence.net/request_content.php?s=46944100097592304445002012515012&a=d7c67e4e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 94.130.102.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.102.130.94.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900012.redintelligence.net/request_content.php?s=46944100097592304445002012515012&a=d7c67e4e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 746A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJtisjkLwiXaSE1nqXdYfO4&google_push=AXcoOmT1peFnpfULqFSKNDczG-UefXogIS0VE3WuCH_eTV6ggwu4_AqocO...

170 B
188 B

28ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJtisjkLwiXaSE1nqXdYfO4&google_push=AXcoOmT1peFnpfULqFSKNDczG-UefXogIS0VE3WuCH_eTV6ggwu4_AqocOtlAzfu2UQjqzHjLygNupDjALQyt8kkuevS8oEUx_U6Cg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-fra-eddf8230116-FRA
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1700578849.178147,VS0,VE89
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJtisjkLwiXaSE1nqXdYfO4&google_push=AXcoOmT1peFnpfULqFSKNDczG-UefXogIS0VE3WuCH_eTV6ggwu4_AqocOtlAzfu2UQjqzHjLygNupDjALQyt8kkuevS8oEUx_U6Cg
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 746A 0
172 B 61ms
19ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEJtrHKVF_c3wPDHBJd9WuJk&google_cver=1&google_push=AXcoOmSyHTcirRH9xgWixT24dUaVdFbsQleVHrq0_kJruRQPGte9lqSD_dkbDfHKRgmCye2yUPCJv041gaeXaLptPIwQ-trLGDv6YQ
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 746A
Redirect Chain

https://s.uuidksinc.net/match/47/?remote_uid=CAESEPr9ytC6924LBr-vLeHYP-E&c_param1=AXcoOmTqxvb1iku305U2pljnUjNP55FoCaFKETK_fEAInIV3O3-JopEV0UAyFr4wR8_0q0rv2bhdJq_5ZHF-k276hTmRgnnYuUPc&gdpr=%%GDPR%%&...
https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmTqxvb1iku305U2pljnUjNP55FoCaFKETK_fEAInIV3O3-JopEV0UAyFr4wR8_0q0rv2bhdJq_5ZHF-k276hTmRgnnYuUPc

170 B
188 B

31ms
29ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmTqxvb1iku305U2pljnUjNP55FoCaFKETK_fEAInIV3O3-JopEV0UAyFr4wR8_0q0rv2bhdJq_5ZHF-k276hTmRgnnYuUPc

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=kadam&google_push=AXcoOmTqxvb1iku305U2pljnUjNP55FoCaFKETK_fEAInIV3O3-JopEV0UAyFr4wR8_0q0rv2bhdJq_5ZHF-k276hTmRgnnYuUPc
date: Tue, 21 Nov 2023 15:00:49 GMT
server: nginx/1.23.2
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 746A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKXkHZT1-8cq-ygabijgwZ4&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEKXkHZT1-8cq-ygabijgwZ4&google_hm=ZVzGIDC2zpOnN-1UnXs5FwAAFAsAAAIB&google_nid=index&google_push=AXcoOmQRD8JNsNGTNFJ6uPVlhuQ7GPOfUnTJF...

170 B
188 B

27ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEKXkHZT1-8cq-ygabijgwZ4&google_hm=ZVzGIDC2zpOnN-1UnXs5FwAAFAsAAAIB&google_nid=index&google_push=AXcoOmQRD8JNsNGTNFJ6uPVlhuQ7GPOfUnTJFGccu_yDDj3IEDTthPTUXQF5n5nKKQH_Ps2R3S9JXfQT8UqHpTfGX_XgKjJRpX8-

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vQkw5P5Xy7rlo%2Bp%2BOoSSj7%2BISipHBjEgFFsf%2FO%2FITER4doKLlWJURRhaq1lfw81KoQoK0QGdAxgAm2jmGVy%2Be%2BuNGFI0JiU2F39eBeWIcdySIbrNwt5SpVdSPOh%2BknnjJRivq%2F0YVt1x1g%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEKXkHZT1-8cq-ygabijgwZ4&google_hm=ZVzGIDC2zpOnN-1UnXs5FwAAFAsAAAIB&google_nid=index&google_push=AXcoOmQRD8JNsNGTNFJ6uPVlhuQ7GPOfUnTJFGccu_yDDj3IEDTthPTUXQF5n5nKKQH_Ps2R3S9JXfQT8UqHpTfGX_XgKjJRpX8-
cache-control: no-cache
cf-ray: 8299cdef080b1c09-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 us
sync.go.sonobi.com/ Frame 746A 0
401 B 298ms
94ms Image
text/plain 69.166.1.35
AS-XFERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAXcoOmSp6Lxb2562GxC4kCn-F4oeSTZgzCWo2DQw_8dNfa0HDSc8U6eiMkbwrN5bYbuBJ08k1fWy6VQruAgTTeKkaWR2U-eJ5Gnd3Q%26google_hm%3D%5BUID%5D&google_gid=CAESEIJXrX8HPDKBvk-u_ubt5Ms&google_cver=1

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

69.166.1.35 , United States, ASN27630 (AS-XFERNET, US),

Reverse DNS

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: sonobi-go
vary: negotiate,Accept-Encoding
x-go-server: go-iad-2-5-124
content-type: text/plain; charset=utf8
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store, private
tcn: Choice
content-length: 0
x-xss-protection: 0
expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame 746A 0
45 B 110ms
17ms Image
text/plain 89.149.192.197
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEB7rz71zP2BQsafLJFec1T0&google_cver=1&google_push=AXcoOmQtwSGf058wUI0dOXSFamfnuaJ2mZouaLLlTVqYiAIva9TXXFEPsmSh0p2NyZsb94ctr9hvVUjt0AwkfmYZI5szuleN_89bGQ
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.197 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-length: 0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame 746A 0
44 B 829ms
279ms Image
text/plain 52.198.239.233
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEOK7hacXp-wROYFp08URDp0&google_cver=1&google_push=AXcoOmT2C_NUdVB1ss8bawDSeuh5pv-jnxmHuHK76iC8w8P4F9NXHQNjQX1kDMwOeh1eZtMgVmW1vT5MAiHqV6smQdq3i9uwJLGyWg
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.198.239.233 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-198-239-233.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
server: awselb/2.0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 746A 0
12 B 24ms
23ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jk4wOFF6aMUM6sRC6-_tUV4cELIdaYUS91-qscjEyExd9YaiN6WdRsvzWe4o4lAupE6YKu

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal90004.redintelligence.net/ Frame FA48 0
150 B 39ms
13ms Script
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/viewability?s=38667000106723804444994012515004&a=eef77f07&vb=m
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=38667000106723804444994012515004&a=bac1a83a
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/request_content.php?s=38667000106723804444994012515004&a=bac1a83a
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 dc_pre=CM3Oz_Gt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2863597191231.755
adservice.google.com/ddm/fls/z/ Frame DFB4 42 B
107 B 52ms
52ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CM3Oz_Gt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2863597191231.755

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CM3Oz_Gt1YIDFQrNmgod3ZALQQ;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=2863597191231.755?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame D8CC 174 KB
62 KB 29ms
29ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4b2b4cc52536e20695a5e3d40666465d174f2323db405dc959bdf5575de67146

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 63903
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 046F 53 KB
19 KB 35ms
12ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=46944100097592304445002012515012&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:21 GMT
content-encoding: gzip
via: 1.1 9f88eecf68d9192420b110f5f3f14fd6.cloudfront.net (CloudFront)
last-modified: Wed, 01 Nov 2023 16:51:16 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32669
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: GLmCZH6B3HwX0TRFlcpxy62Nyhn2NbLOJCC1ni2GjZinZEVWb98pww==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame 046F 85 B
439 B 31ms
8ms Image
image/gif 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1700579148&Signature=DVYjDH6fdszaok-6pliq3sD2slkUa9N~ToeVJIiA5YVDvEJ2QUHEL5p35Wn~sa-I4BF5l7Kb0Np4KfIVvOZv-t0HRLDOK~~BBN8AJtrCTNueqRlN-gpK0i-k9etfQhR8g5zdNEmbTbSBDedABnNUEogB3wjhnvjzoMD0PRq8jv4ixnSLcGmA9KLKKo4xC8ARysw1vscw3WYgnG1MfElCI4wpQSRrOozVcMm-EYPvjOU2MoR7Oumkz4DUJLAHmhH2XsiD1TLgbzgmAK6euICQZSB6HPXoLoUU5ZIaHB77J2te5IP3OUO4d8toOCVJmz1VRcB0KSnJYa~edDRkEzf4Iw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 10:57:54 GMT
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 14576
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: FUzoCYLFyTAqOkmTLM0YMNDE0mVvkyjcRaZZXPSgbdyWSN_Fk9buRw==

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 5142 53 KB
19 KB 27ms
12ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=38667000106723804444994012515004&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:21 GMT
content-encoding: gzip
via: 1.1 9f88eecf68d9192420b110f5f3f14fd6.cloudfront.net (CloudFront)
last-modified: Wed, 01 Nov 2023 16:51:16 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32669
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: VFTVeS7OniAuH_REePFt-AoAp1oJ_Z0CPbdXBjrRvXibLbiVNTgkxA==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame 5142 85 B
436 B 23ms
9ms Image
image/gif 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1700579148&Signature=DVYjDH6fdszaok-6pliq3sD2slkUa9N~ToeVJIiA5YVDvEJ2QUHEL5p35Wn~sa-I4BF5l7Kb0Np4KfIVvOZv-t0HRLDOK~~BBN8AJtrCTNueqRlN-gpK0i-k9etfQhR8g5zdNEmbTbSBDedABnNUEogB3wjhnvjzoMD0PRq8jv4ixnSLcGmA9KLKKo4xC8ARysw1vscw3WYgnG1MfElCI4wpQSRrOozVcMm-EYPvjOU2MoR7Oumkz4DUJLAHmhH2XsiD1TLgbzgmAK6euICQZSB6HPXoLoUU5ZIaHB77J2te5IP3OUO4d8toOCVJmz1VRcB0KSnJYa~edDRkEzf4Iw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=38667000106723804444994012515004&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 10:57:54 GMT
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 14576
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: Eu5nFns2ILZDUH_GG83t-u1iVFguKZxBxmspz1bNT524TKtSSzzHXw==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 564F 0
20 B 55ms
51ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bi53PIMZcZc7nEIT33gOcia-oCwAAAAA4AeAEAg&bg=!MjGlMX7NAAZxrfrxUa07ADQBe5WfOD-aLZszudrKT0d2GRLf_oh4E7AWxWuB00Eo43fl9tfPriuS4AY3Y3fKj5v5R1fPAgAAAgtSAAAAAmgBB5kDCre9g3f0b1TpdUIfkK84sA6A4FbUgzUoDNylNm-2V-lVXJcoSCUzFNnDQxMCfi1GztETkSlNbJernTnU9Z3QoI_wIpUmGZIwfn1AvAzDL0qgC7heutajrSxR9EXM4Nz14kseVtvat-5O3Px9AFjEpHcds-yD1zPAv2kNImXOZQ51Vegb_ZlTrV_PhK9gL3Kh3ETYH-ow1hm-t1v-cDCEWCpzQZi4qK1-jrX976gbh2GJJp1LMmoJRGDYPFJLCFWMPmNNYTqxmLfoCZXEFoSUgLa2BWllbxZzsptqxwzQt9vTpgNQF8Q4EjqaFsq4DI0OvtTEbPtU3DQg7-hKuYIRVFIZ4c21FQmm6ldsROEEXTYts71Y5lPgmbu-PTPdAI7Aq7Rdmh_Eud5DzArlE13DRGQjGzpWrl2VyAYMlR1KktMOpxvwCHZo-QxfdvpzwXw8DJQ5Gv8R_1M-46HS8o4T0ABHeMfcQMgcMIjfe8qSC91Lt9FkALsURFmuek58NHuXXyyiNiBIIhq3jvdeRVR-FBGOipcHSyYyyW_sFp7viRzMnmcBd2pvBW4mauK0AB62dr4w7-wIEgZX_Sf5v5JoC1vkpfYhL390o-4yp_i5KV72Ib35ZRjTHr29brp1bgrK8bKQdphqYS_l1LJFPqo4-zkRhXTAzqaJNOsZhsP_opKMdS6_zSDfQr71Q0bEl-PiWGpCF8ld5-IcWfXMYELWsaQtv37oOZvuZXhtdOSwvcKtGkcy1foI48Zt-4RXtJhBJ0AxnRGeZrsKOQMEDcUvzu0x5YQT_GniHhQH9mxT_v8ogA6I2emsmqhANiYDiIle1kTKzQdmdqQdJrvmEyXLkK_n9ekZvvfluglVxzNbu-s3_ChpKdfkyS74_ExHMXhO1VKEp4HXiEfrlNYuixiu4pcAe4SLRnaL9-5W5m06I0kx7esLe_w_rBbwN7dD94mJxQQGIHJxgDU61j5QswAY0B95uN0S5vU6sWf_Y2LXgdWDOrIPAjwqM55pY1o6FhtC0KS4twqH_ZfPYKo

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame A06F 14 KB
15 KB 21ms
16ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900012.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 324630
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 20:50:19 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame A06F 15 KB
15 KB 25ms
20ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900012.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 367072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 09:02:57 GMT

GET
H2 200 link.html Show response
track.webgains.com/ Frame 9006 2 KB
2 KB 77ms
70ms Script
text/html 13.42.237.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=47795800099584704444550012515009&nw=1
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.237.35 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-237-35.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: d409a6f12580163df3f67520922ac3b46a27899d95e96d9d8f280200cafc82ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
last-modified: Tue, 21 Nov 2023 15:00:49 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:49 GMT

GET
H3

200

activityi;dc_pre=CK7U4vGt1YIDFV3MOwIdDpMKeA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3079521783723.196 Show response
5994599.fls.doubleclick.net/ Frame 7E35
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3079521783723.196?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CK7U4vGt1YIDFV3MOwIdDpMKeA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3079521783723.196?

391 B
240 B

70ms
70ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CK7U4vGt1YIDFV3MOwIdDpMKeA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3079521783723.196?

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

effd6f6480a7672c51ccb89eb301a43eaf5e37d2c292befd81492ff92d283670

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:49 GMT
expires: Tue, 21 Nov 2023 15:00:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK7U4vGt1YIDFV3MOwIdDpMKeA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3079521783723.196?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90009.redintelligence.net/ Frame 8C7F 7 KB
2 KB 43ms
17ms Document
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d38e7ce87a2eabf72fd53767254e020185000c74493465e448b26f161eede2cc

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2076
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:49 GMT
Expires: Tue, 21 Nov 2023 15:00:49 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F39E 1 KB
643 B 18ms
16ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62636
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9006 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: efaaf8d4d72192ca1e894f9f004cbd911112da5a46f24a2b5cae66d77d7ce72d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame DCC3 53 KB
19 KB 12ms
11ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=42777500112678604444990012515010&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:21 GMT
content-encoding: gzip
via: 1.1 9f88eecf68d9192420b110f5f3f14fd6.cloudfront.net (CloudFront)
last-modified: Wed, 01 Nov 2023 16:51:16 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32669
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 9FwOQyXDQrfMbXWJxPoXHMsUe9XUlR4zwIWcMdWfjBbOP4HfmNXGDQ==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame DCC3 3 KB
3 KB 9ms
8ms Image
image/png 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1700579148&Signature=X4l8o0alaJ~bhoDdHTZqnAXOeJwUBu1q3XqaYn7qG9LKfLBQVMywHsifU8elR~Whk~vRQ2HpUO4Haz9FTVnsOfodtHcveBVZiXDQ2m4kOcIPNUd4pY1bLRRaf6MtsuFeV4lPGBpEza0BqANkjNyGlRwvQMXf7PW-gl-4esbwzGLuZCLhGnRvyQJUh0cz~k-Iawfmg0u6qCJqFaP1mN~gl--74gM23vYL9UETZu26M-vvZIrcOfowruiKm8MMtv3iC7eVpPaUilLcV5doCh7jBfX4KMio1Tbe96QnfZWy-xKEggVKOTsaRapC2E2MD2YQPQBuwFBycHws44DvuFWMcA__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 07:14:28 GMT
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 27982
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: K-StfrUTDl6f9o9tlktP5zS31rm7JirUab0Xde5RWHcxGlrXPRRGRg==

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 191ms
187ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdefcccc2c41-FRA
date: Tue, 21 Nov 2023 15:00:49 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HsfXY3vJEJ0phHXaAYynJ9yvblmfCjP8qHR6LVqsObf4YXQJ2bkfuNhCVjbZaRX1q1rAbIy4oXzu9Wjxl9Wg%2Fk5yB55ZjLixQrreGmDXyu0YAOnVn4qYGxngbI5W9uN1TMK9qXlsR9egVEN4rKU%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 109ms
109ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oQvPukXHjueCV80rQu1lqt5e%2BkzOdsfuwySu9HMaHuCBJQojgif5QPA99dFb74DtLlocGISQ7q5tWwDjG547GIEUBtR26aHZiw%2Fjg9uNsVqPO57DlI9UEEIJaveIVNB1cYVkWe%2FKqMJNEdvChwQ%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf0fe2f2c41-FRA
content-length: 0

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame FA48 14 KB
15 KB 15ms
14ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90004.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 324630
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 20:50:19 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame FA48 15 KB
15 KB 16ms
14ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90004.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 367072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 09:02:57 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 561D 273 KB
91 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

971be0d9f761adcc260f56e7312322748383aae44263d37bf172e27e043b13c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92854
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H/1.1 200
OK viewability Show response
hal900010.redintelligence.net/ Frame 58C7 0
150 B 47ms
14ms Script
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/viewability?s=42777500112678604444990012515010&a=1407fbac&vb=m
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 1751
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEL2OOw9720mC4BR2kr3w4cI&google_cver=1&google_push=AXcoOmTcPVQvojtdL4LLZq7fciALA22qKc6Y4a3a1jqn8scT7lQqPtCuB6_LmTnmXbXuOb7QafvrBP4KcalSzycke5ObyF9NsBKcWg
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=NzA0MzI4NDM3MjE4OTEyODYzMg==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEL2OOw9720mC4BR2kr3w4cI&google_cver=1

43 B
398 B

66ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEL2OOw9720mC4BR2kr3w4cI&google_cver=1
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEL2OOw9720mC4BR2kr3w4cI&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 1751
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEFAspsU1EZ5EJpVhuJMNx08&google_cver=1&google_push=AXcoOmQ4qEK8GfhLXpilnYu8HUPBh3MufWCMlo3vRwHVjuro6Zf0MVmfjTcDezsI4I3rkCBrxbA6O1mBdoYX509f2chUSuxB8sD1b...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFAspsU1EZ5EJpVhuJMNx08&google_cver=1&google_push=AXcoOmQ4qEK8GfhLXpilnYu8HUPBh3MufWCMlo3vRwHVjuro6Zf0MVmfjTcDezsI4I3rkCBrxbA6O1mBdoYX509f2chUSuxB8sD...

43 B
418 B

187ms
186ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFAspsU1EZ5EJpVhuJMNx08&google_cver=1&google_push=AXcoOmQ4qEK8GfhLXpilnYu8HUPBh3MufWCMlo3vRwHVjuro6Zf0MVmfjTcDezsI4I3rkCBrxbA6O1mBdoYX509f2chUSuxB8sD1bg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQ4qEK8GfhLXpilnYu8HUPBh3MufWCMlo3vRwHVjuro6Zf0MVmfjTcDezsI4I3rkCBrxbA6O1mBdoYX509f2chUSuxB8sD1bg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8299cdf1491a37de-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 101
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFAspsU1EZ5EJpVhuJMNx08&google_cver=1&google_push=AXcoOmQ4qEK8GfhLXpilnYu8HUPBh3MufWCMlo3vRwHVjuro6Zf0MVmfjTcDezsI4I3rkCBrxbA6O1mBdoYX509f2chUSuxB8sD1bg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQ4qEK8GfhLXpilnYu8HUPBh3MufWCMlo3vRwHVjuro6Zf0MVmfjTcDezsI4I3rkCBrxbA6O1mBdoYX509f2chUSuxB8sD1bg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 8299cdf01fb537de-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1751
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEPGWK7TozjHKPpO6BPbbE8g&google_cver=1&google_push=AXcoOmT0B_n0jVCPsbMn5lMeMRltplcbs-4tnW8gNLqo26UVFLTGHaEjbt4_wMnCuH3PbmWA9E_lvsnCF5cvqBAmWpdH_TRusAvT
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmT0B_n0jVCPsbMn5lMeMRltplcbs-4tnW8gNLqo26UVFLTGHaEjbt4_wMnCuH3PbmWA9E_lvsnCF5cvqBA...

170 B
188 B

27ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmT0B_n0jVCPsbMn5lMeMRltplcbs-4tnW8gNLqo26UVFLTGHaEjbt4_wMnCuH3PbmWA9E_lvsnCF5cvqBAmWpdH_TRusAvT

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmT0B_n0jVCPsbMn5lMeMRltplcbs-4tnW8gNLqo26UVFLTGHaEjbt4_wMnCuH3PbmWA9E_lvsnCF5cvqBAmWpdH_TRusAvT
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 20 Nov 2023 15:00:49 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 1751 0
187 B 81ms
18ms Image
text/plain 98.98.134.243
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEMoWkkTyd0QTMl3ciBVYFQk&google_cver=1&google_push=AXcoOmSaxm-KFJ3znXTrNSnVnTQqx4y_VgkMYcSyW1XMeA2S9_sN2j_xnAb93tFMq1jqkTCzf4qctoGT5vSNGP9Ay_njxEgdlTiaug
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.243 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1751
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESELVV44Q_ENoafnHT0F0XrPs&google_cver=1&google_push=AXcoOmS8Tb-UAZdQp8GuJCpGoOUaz8eemiheqnjqnEvs6oSdv4d8XTGHAyPEwN7qauL60SRu1Wg_V1iO...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQxMjE5NjE4MTk4MjIzNjQ5MQ&google_push=AXcoOmS8Tb-UAZdQp8GuJCpGoOUaz8eemiheqnjqnEvs6oSdv4d8XTGHAyPEwN7qauL60SRu1Wg_V1...

170 B
188 B

27ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQxMjE5NjE4MTk4MjIzNjQ5MQ&google_push=AXcoOmS8Tb-UAZdQp8GuJCpGoOUaz8eemiheqnjqnEvs6oSdv4d8XTGHAyPEwN7qauL60SRu1Wg_V1iO1hqkDCumkQatvymW6fLLFA

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTQxMjE5NjE4MTk4MjIzNjQ5MQ&google_push=AXcoOmS8Tb-UAZdQp8GuJCpGoOUaz8eemiheqnjqnEvs6oSdv4d8XTGHAyPEwN7qauL60SRu1Wg_V1iO1hqkDCumkQatvymW6fLLFA
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1751
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEDZKcIq6R1zqeI4gjldeH6U&google_cver=1&google_push=AXcoOmSxQgBvulS-u9-yMMEnWnqGAgCJkCeELEd0gYYjlU1YV2JBVJXfu_-KHGcc_U04YrACt5Z-WH0Uu3610hldrZ03FBl...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmSxQgBvulS-u9-yMMEnWnqGAgCJkCeELEd0gYYjlU1YV2JBVJXfu_-KHGcc_U04YrACt5Z-WH0Uu3610hldrZ03FBl-zwevQ44&google_hm=NTg0ODg0...

170 B
188 B

40ms
40ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmSxQgBvulS-u9-yMMEnWnqGAgCJkCeELEd0gYYjlU1YV2JBVJXfu_-KHGcc_U04YrACt5Z-WH0Uu3610hldrZ03FBl-zwevQ44&google_hm=NTg0ODg0MzAxOTIwMTgzMjU2

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AXcoOmSxQgBvulS-u9-yMMEnWnqGAgCJkCeELEd0gYYjlU1YV2JBVJXfu_-KHGcc_U04YrACt5Z-WH0Uu3610hldrZ03FBl-zwevQ44&google_hm=NTg0ODg0MzAxOTIwMTgzMjU2
Date: Tue, 21 Nov 2023 15:00:49 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1751
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEF0flryBW3uIRx925iFhUgM&google_cver=1&google_push=AXcoOmTzxc4IUVHWJD4sHpVIUXYNnZjsVUk_lxwOZXPFNS8ZNQ4aDvBgWugNHakKI5l...
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTzxc4IUVHWJD4sHpVIUXYNnZjsVUk_lxwOZXPFNS8ZNQ4aDvBgWugNHakKI5lwS_-WsqtlRfIxmqMzZDsO1283rYozvdmm_6E

170 B
188 B

24ms
23ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTzxc4IUVHWJD4sHpVIUXYNnZjsVUk_lxwOZXPFNS8ZNQ4aDvBgWugNHakKI5lwS_-WsqtlRfIxmqMzZDsO1283rYozvdmm_6E

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-akamai-request-id: 39289715.6acd5fbd
date: Tue, 21 Nov 2023 15:00:49 GMT
x-bytefaas-request-id: 202311211500493BCD068AD09D60081383
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a2-16-239-13.deploy.akamaitechnologies.com (AkamaiGHost/11.3.2-52183077) (-)
x-parent-response-time: 91,2.16.239.13
server-timing: cdn-cache; desc=MISS, edge; dur=86, origin; dur=6, inner; dur=4
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202311211500493BCD068AD09D60081383
x-cache-remote: TCP_MISS from a23-218-219-29.deploy.akamaitechnologies.com (AkamaiGHost/11.3.2-52183077) (-)
access-control-max-age: 86400
access-control-allow-methods: *
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmTzxc4IUVHWJD4sHpVIUXYNnZjsVUk_lxwOZXPFNS8ZNQ4aDvBgWugNHakKI5lwS_-WsqtlRfIxmqMzZDsO1283rYozvdmm_6E
x-bytefaas-execution-duration: 3.30
access-control-allow-origin: *
access-control-allow-credentials: true
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-host: 01782c1aa098d441e14c7848822c4a7ef035ca4356bbab9b7d40e735f7919a2b672291728097bed43322bfa279089347357f73fd33b9e74c8e347c12abd56a76733d302a437475b103526ec5263e4522c3a68252c446c0ebfcde5fcfaad68b81808fda2f6e36896f62d915c4081a51caf2
x-origin-response-time: 7,23.218.219.29
cache-control: max-age=0, no-cache, no-store
access-control-allow-headers: *
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1751 0
12 B 27ms
27ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LcLqCic9386Vcm-YjNdsPNRfLkdO0rDUvLlhVaKxO8OOY6kHK7WIF3anyMgx6dYsHyr8buhFI

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame E691 273 KB
91 KB 27ms
27ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06514f2abf9645ed16b8c751078db535d817c2908af435bb613181a20147e962

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92855
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 11FC 0
20 B 50ms
50ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bsm4xIMZcZY2pEKPB1PIP-qOMmAMAAAAAOAHgBAI&bg=!OzilOHfNAAZxrfrxUa07ADQBe5WfON3kquuswu2nVdgcYm59TG_ER3or4I-WXwiipdOV1povTjbAx09pbrHTVl1lX_TFAgAAAlxSAAAAAmgBB5kC-JEseR02nlHSjjl8hz59Nk07LXp3YH_CI_mKMLD-ZM6ck4xymV03Se8jlkAw2b_ajh-LtA3jOpBCtXdi2ulhUTfvCUnBNPfUZnWpL7thtM7U8jo1NxJ2xihUN7MbbLNYnn0IeA5C8-FRSm6Pv1XkcdQOENn_cqOXJIYD_ReM0DfbaJIHPgr5IaY9RgdQLLNGC1T0asjkVPpm3iYWDy4y4BKD9yrrkrSAWdi2FVEbtijFRElWForzSTHZ4gehOTTB9Xvy9etoGbgAtah2r16RVrydbB34xovXTIU0NKN8heBYpQtG3sZd5ji1rTj5G_ydWMnmD1C-gE4feCPCRzsvMYQCkFtSK_VLSb3FXqc-zjHNaR6SaExW4oSr1pdyL7PdSYI1CaKuWVpQCcjs0U4Chc0tj0LwSRQSshd80SUZ5LQWAVZ5JZXM_UN65FRq1BF8PEW80GAYwQH__tV7j0UEhxTF1iGnQqWpfj4XM5l__u-Ya_-a4jIP5jVWPdHNlq347ew2EA02jX5sWZLLqOZjme6fdyzRIiAfolKnh3GJGhrdIRzHLp6rZAsMKSfFKgmXO4JBNuVsBFlai4vYJwBIcxyoHIbDMWQZhPPjDBbClwcBccobpXvzW0RIxruMo5ec3vmwGspGKfwZR9VhkAfErrKaTMQihug-t_YK3DSpERqknMoS6blV09ud3jZ7QZeyG22GfHZv6mZHK871RK9bw032_z__kc-FKp4W-bl7uZPsfFsTxHwJUzsb-e2pzwEuXFwtqr3dwMds__Rqgl3co9y3nh0LUCbGX5hMjj6Xv1gWaeQrh-AGiY3Hb0H8rj6LSwKJUUnf6oxAu0AW29bY1Fb1ICcbC3jyjQu7DWEIPu6ZgancPMv0iidBm-x-lpB9nBZou3LA9UXVP-CSzK_kk7wSgcOTjaZ3u_liRz-VsrQGoJ4_eJ1KrN_Kt6jsTd8IdPs8c3jx9yiDpHn9gVzHynv1UaB-WTY8fYjtydewgg6r6noMywF81Lw

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 378E 273 KB
91 KB 28ms
27ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06514f2abf9645ed16b8c751078db535d817c2908af435bb613181a20147e962

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92855
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4B2 0
20 B 54ms
53ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BUbM8IMZcZbmJD_yp1PIP9rmOkA8AAAAAOAHgBAI&bg=!DwylDEPNAAZxrfrxUa07ADQBe5WfOKaEXqywnxA0hLJjqsibIfrLUNavsZzgdn-5yaI35TCo-j1CQhLtIXDHBTEG34RfAgAAAlFSAAAAAmgBB5kDARNylUITz2mgyuqIcAfcdEQU4sqWbYgPxUVNx2v5eEcmF1RCRbpFLUruIAW0tGhG88LUYWOer4KEWw7Qmw1cRgmczzVL-uzedXqLnaudGK8ZIXQg5TIHqXTYYf1UQnb3c8Sh4FlrJFfll4PczAF0FEzIyd1ffKlPKHbLm8KCRoQO3r32RFiXZeUb-MQWoixuAnVSKKgkRu9pJDDhbwNsG1jNzQ71Vv_zBGXt2KrK9s-P9FKq3Hzta13Q2e5btOCUhS8zRnBu-_TXmajQGKi1kBExrMp9GdKVWxo22GsThFef-FGu6ic_l4D5KuCm7b4OEyI0R8lOI7XGHsAfO3zLrLlplrSZ2-277_wZKsH1RnGABfdaXXo514Igbm6QPG-Gq20TCgpWsE00ICV4rMXW0FizElCWquD-YdxMXZf8w7B8DIUPqUt4TEOknAA6wFq3p_zU7OhF7IUA2LWZ2C7JDmYj7BdJKwUGc9RUsumOJqceLB8G2CaK5k98hgeLrgtW8jPRsCjDd-FaeikkjnzBVmNgLau4j_v-hBhNwM0WznN3U1jY9WCeQxmxvZ4RXDQCjNVByBBKCjKbTJq8iL0TaSiiRcvIZkPZvLpZhg5xBNByldW_0UnnLQSnvJPL8aG48WIroA90cOaMTfL6AbmEzmmkYav-9X_AO5syGQ3VmOWJCO6cu0fUNJDiXvHwH_SiLYp5E4Y_qUhU5WQvUIy9ctMzsjld0wDYI-0IeRYGiJrLdaaHBwMoOkng1NMgYGfY-3YzfOy9PtMBbcHxNHib9JAUFM5AB5e-SfgtTgiYWZrnRlRgrkQZhFBHxzfFAw3uIs4lbltI5N4Z-hyb_hlxF7t_vGPU44uuhu-3byfhjyzZUM6ZvrSzoRRWrNcLwm1CTh-89bhDAgcb9xqDFhImiKcN03EE0-OM_C3dnLTgm2Cf9blKUMkCIwomFvuHhrU1nv4wq2JQOAIyR8gAVS9Uf3H0Dmq3MZaX_S5GQoJhLmT5sQugpXUsj4suwOmOcz7fEEE

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame BF6C 273 KB
91 KB 30ms
27ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06514f2abf9645ed16b8c751078db535d817c2908af435bb613181a20147e962

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92855
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 8C7F 2 KB
434 B 27ms
25ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

bf5b911ce6645add415b3dbf40d50dc8cda426f38f5300525bf4793c4131b2c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 14:48:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 8C7F 17 KB
17 KB 42ms
14ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b4b239eba09e8485750d875f6896c5d3dd964b2d2527c147c0fa783ae46465a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 8C7F 16 KB
16 KB 41ms
14ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 59f31498d281202c276e09a063b5fcfb75c8b4c983bd8637a5acaa0db90dd68f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 8C7F 14 KB
14 KB 39ms
14ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/image-1200x627.jpg
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 518231e0e2e73091807e2a20453c25f3d4420287c335402a9ce28bb972e8c31e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13920
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 59EE 0
20 B 52ms
51ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BbH2tIMZcZbuyD8qL1PIPyN65wAIAAAAAOAHgBAI&bg=!SkmlSQbNAAZxrfrxUa07ADQBe5WfOAspohI8Z_egsOYVWrko1DtjzKqH1AFsrHNGaG7DR2cR21Z4glwIf85tXuIBzwqoAgAAAg9SAAAAAmgBB5kC_4iUwLKvJpM_b_2sBdNV0UxRqkDFuDAmo22JYm7mHcHvpiCpEJdKFOScrykaSo0sToEA02baSEXpFku45a2OxMwmqubEb32uBR3Btx2QYT_DsEbfnk25U_-s4EZPWA1H66AQ9FjBuQ6WPKIyFjW8-ihMJAlOW4VzrDW7kqD7P9OEu15ywa2YHU8DbEnKRnYlJqcYms-j_ddsdvBQkcykXc_B7kejS5FErdNFmsDli8W0SnJ1A2dg4mCxh-Pj84iCwUTlMoDeBHxTTNsOxklMLKYzCbVEA_QcjzS1RmyV2ty9FuFSGTGLl8YeDZjQCkePUMY0VrmfCX670PV3FcSwFdEds5l2z5KG-CmyY38tYmaBw6woLCNcHmqfh1Z92nvK0YrL9X6y2DK7ksCivsQzeZCVtBl7F0oiZMcuydEBzqrCD-re6HcW1WAjMOjbK13MOi0ryx_3xd5_T2g7xnrGtrYE-tEngoOARjTl28Sx99d0pVOjpmf2TNPEo4lW6MOm-DHcdd4NI09DUaGIsgz5_zJ_ZU_HBFXr6Xy9kRORBhm6aGcVpwDWHRAiaUABwhGf0MG-rNr28A8a_UeVhyiuuaxREy8Zeq-vFjILepjOgKm9v0BD3pKqRSyQQAMxyS1iC-BBlmXivAM4uj8ymUIc-F8LR-WtNrSYp0STycjJFsYZb6-zYip-ihseTiRudrOJn1OymzQBLE8NOAhHuDVZgB4_nuWFUgARWQqitWEXDfCV4cAvx7ybrQE2bdXTu8SbmbIjyLm_m5PwQdkr5DTbJq_hGNVV22B5F8O_brIJe0NAsfXCWZOwPiSfvCnvxG3sYTMBSiY9z66W-SF5ySaBMKMyKF2CrLsxgbMOrgR_1cXWgHLmQd53_EpeID-Z8_2-WyjKD_nVJ6izCLn6xjd0leAks-6F-G9NqAq1LpXR6w4aLehi01GM8SwVx4C9ih3EZ8rt0-ee3PXZYqeaR7WkaI6J7hHIFCqqPfC53djOzHVKFLRR9y68w9VoSnIV6GDA

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F72A 0
20 B 51ms
51ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BxpGFIMZcZZPaEI_2x_AP35CPwAYAAAAAOAHgBAI&bg=!JSalJmnNAAZxrfrxUa07ADQBe5WfOLQEiFbNTYadbgJ-ARXZD8EkV8DIz9XIwj7kUygY3uKz8u329lmC7DfwBfcp8imPAgAAAkRSAAAAAmgBB5kC_HDpTgmePGjxCUSJJ1Dw3vIvLJS_ezhZy8IErPxzRP_A2fLRn5eF-W_IkxsZKnWQo5ZCrIBsGP4GkMFhWmlW9f_h25REI01XLUMuIw_iVnwYJ6RbSiLegAHvRNL0TWzU48x0NX_4hjRk-OBwqcznIsbFRjIf7sfMBRurenn-uqk2EfRPr9i6VmmhBaRrr3yx5-a0QtA8PkFgogv23FhuAaSUI-MSPoN0ijru6mbapSW2nNA0Eb53dRyzPlpmzO4TxCuT1k1JQO4iiLlIZ35x0hKAchW9BZujkx8aufR8uKp4rfBamC5CQWPCYqFPWLfAVepFp_y_4ugJKrKL9sjr2m6BAS_V8N0Anif6kKLRS-mlH2reZKZkCEQuzDVjHMh5czwP1Wy2jvcaPKW_A2AYmgBajAiHjDe0KmtzlHT_w0V0T4eFEfJJXcE0NeD2juXGbRY7D_mLPvF5y4rfRkMxWTt2vCL82_8X8mWwRR_kG1Yd2Ez0USjsXD5KhwXrNhrlerYcP2nTNfWC-N2uUiBgIN7RL4EmnFkKusS1NYUeAjzgFX-eBAi3WpH5o5gBT4hDnR9bid-9HsdrLgx2qgucicLpfqy665LsdiZqOTMAPy9obsQBPetyoFzg75I_dAaj8fIIFIb-UikkyjY0396aRcY4foMOabSHiIvG_g30-e1O8aalYPQRiEhnQpvr21HJkJWToQ6avSqhkboBUyCxML9wRn2ziC9SRlh8RdXWqGqPBT4zv-kAdxEzX7pDPMAKqQc3gVIwuSpLjf2mOuYfzJwlMwMGOaOSMAWkt-8CO_qp430Ndj9vm6uKAw2Eb3KDeNmHxR6DhZl9-t6V0gHJMsKUQ6er9ZvNmoaMS_o_HkWtU7JZvc3ufyz4LWx5ErLcUcLfnuKC-m-ugsQNM5rG2IhWPPijhmQ0piv8cUZ6Abs74fTW2248OIaqwIDdtXTzdKTJdP3t0gpUcMB7kAU0g_j9VU5TMI7-OKre6XRPXxlcO1zx3ApTj2rOEyC6

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 58C7 14 KB
15 KB 16ms
16ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900010.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 324630
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 20:50:19 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 58C7 15 KB
15 KB 17ms
17ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900010.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 367072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 09:02:57 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F39E
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEPGWK7TozjHKPpO6BPbbE8g&google_cver=1&google_push=AXcoOmQ5bNY-DLJS-nUhYyOzZe-2pWQnMlRvLPYwAr8yaxAQ-H-0UdG1HH03fgPORFE1FuYDjL9XWz7XviyBfcvHTprL6F-DSSFFfg
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmQ5bNY-DLJS-nUhYyOzZe-2pWQnMlRvLPYwAr8yaxAQ-H-0UdG1HH03fgPORFE1FuYDjL9XWz7XviyBfcv...

170 B
188 B

27ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmQ5bNY-DLJS-nUhYyOzZe-2pWQnMlRvLPYwAr8yaxAQ-H-0UdG1HH03fgPORFE1FuYDjL9XWz7XviyBfcvHTprL6F-DSSFFfg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=C019B42070B84A7398EF0B971B022218&google_push=AXcoOmQ5bNY-DLJS-nUhYyOzZe-2pWQnMlRvLPYwAr8yaxAQ-H-0UdG1HH03fgPORFE1FuYDjL9XWz7XviyBfcvHTprL6F-DSSFFfg
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Mon, 20 Nov 2023 15:00:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F39E
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEAgoa9ZzwGUpD7-ZBK9MkgA&google_cver=1&google_push=AXcoOmRJ2eyValBc-dteeTngzDg7wM0uyxTMFmyfv6opmwDlxHQ8Ute5RrGSWTguJHRENQJmvzGYVeyjziz...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRJ2eyValBc-dteeTngzDg7wM0uyxTMFmyfv6opmwDlxHQ8Ute5RrGSWTguJHRENQJmvzGYVeyjziztnBEQnZy5LdyQMlcDkw&google_hm=Q6S_ZHBORm-syEsxN-...

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRJ2eyValBc-dteeTngzDg7wM0uyxTMFmyfv6opmwDlxHQ8Ute5RrGSWTguJHRENQJmvzGYVeyjziztnBEQnZy5LdyQMlcDkw&google_hm=Q6S_ZHBORm-syEsxN-aTP4M

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:48 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AXcoOmRJ2eyValBc-dteeTngzDg7wM0uyxTMFmyfv6opmwDlxHQ8Ute5RrGSWTguJHRENQJmvzGYVeyjziztnBEQnZy5LdyQMlcDkw&google_hm=Q6S_ZHBORm-syEsxN-aTP4M
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F39E
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEH1KyNhqkkfiUJ32pT4g_ZM&google_cver=1&google_push=AXcoOmTCXzz6ljv524AJZ69bnIPvL1DHTs4zp9Ezbm3B0SV1jViBgKVnwO4V7zE4vxM8p9GxlC0Oh-ISylbgRb...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwMzkzMDU0MDcyNzIwMzk4Nw%3D%3D&google_push=AXcoOmTCXzz6ljv524AJZ69bnIPvL1DHTs4zp9Ezbm3B0SV1jViBgKVnwO4V7zE4vxM8p9GxlC0Oh-ISylbgRbM5cZ...

170 B
188 B

27ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwMzkzMDU0MDcyNzIwMzk4Nw%3D%3D&google_push=AXcoOmTCXzz6ljv524AJZ69bnIPvL1DHTs4zp9Ezbm3B0SV1jViBgKVnwO4V7zE4vxM8p9GxlC0Oh-ISylbgRbM5cZR5JVzaj6FoiA

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwMzkzMDU0MDcyNzIwMzk4Nw%3D%3D&google_push=AXcoOmTCXzz6ljv524AJZ69bnIPvL1DHTs4zp9Ezbm3B0SV1jViBgKVnwO4V7zE4vxM8p9GxlC0Oh-ISylbgRbM5cZR5JVzaj6FoiA
Date: Tue, 21 Nov 2023 15:00:49 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2 200 sync
x.bidswitch.net/ Frame F39E 43 B
145 B 13ms
8ms Image
image/gif 18.197.187.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPwn_qxEh1IJH9ZtqsfSVkY&google_cver=1&google_push=AXcoOmSfH_amaOxQMKmG8ZD7NAxw-_RPzU-EKzSk9VoqCekPAxUS8ecyK6CF6qoURh504Oi0LabO9-zkveN6klvcKKoKUCImrMFXqA
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.187.29 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-187-29.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F39E
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEJUbNfA4h3l2Ol3NMSVYEy8&google_cver=1&google_push=AXcoOmRi3HlmhUc0SJaydnh2fox4zfFkfrgky7ovZql1UyajI9Q-EQOcCUAyqaql5WhJkr-NYu6TiLYHLa5sA...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEJUbNfA4h3l2Ol3NMSVYEy8&google_push=AXcoOmRi3HlmhUc0SJaydnh2fox4zfFkfrgky7ovZql1UyajI9Q-EQOcCUAyqaql5WhJkr-NYu6TiLYHLa5sA...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRi3HlmhUc0SJaydnh2fox4zfFkfrgky7ovZql1UyajI9Q-EQOcCUAyqaql5WhJkr-NYu6TiLYHLa5sA2VD7n3OQjmNmqXD&google_hm=cGo2aDBXbV9Qc3R4QkI4...

170 B
188 B

27ms
27ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRi3HlmhUc0SJaydnh2fox4zfFkfrgky7ovZql1UyajI9Q-EQOcCUAyqaql5WhJkr-NYu6TiLYHLa5sA2VD7n3OQjmNmqXD&google_hm=cGo2aDBXbV9Qc3R4QkI4NmJOb3o=

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:50 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AXcoOmRi3HlmhUc0SJaydnh2fox4zfFkfrgky7ovZql1UyajI9Q-EQOcCUAyqaql5WhJkr-NYu6TiLYHLa5sA2VD7n3OQjmNmqXD&google_hm=cGo2aDBXbV9Qc3R4QkI4NmJOb3o=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 sync
ssbsync.smartadserver.com/api/ Frame F39E 0
44 B 20ms
15ms Image
text/plain 89.149.192.197
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEB7rz71zP2BQsafLJFec1T0&google_cver=1&google_push=AXcoOmSw9Rr0iN0O8leN5tJ6qGuOSgwn74K0xRIg9fgOJ4W8SFvm4YR_WH2nh2-FIrOSsl8baQkCgN-KZdd_k49F1J8KhUkGwHyl4A
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 89.149.192.197 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:48 GMT
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F39E
Redirect Chain

https://analytics.pangle-ads.com/api/ad/union/gg_cookie_matching?google_gid=CAESEF0flryBW3uIRx925iFhUgM&google_cver=1&google_push=AXcoOmRg5YBmOvr4vhOQ-VEFERcZuNRu6oTI7liGFeFrFACM02BKvSkKlRFvip1JpIS...
https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRg5YBmOvr4vhOQ-VEFERcZuNRu6oTI7liGFeFrFACM02BKvSkKlRFvip1JpISTN_fK0h-hgggWLWtmQYobqeEbFe-ro_sB9TM

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRg5YBmOvr4vhOQ-VEFERcZuNRu6oTI7liGFeFrFACM02BKvSkKlRFvip1JpISTN_fK0h-hgggWLWtmQYobqeEbFe-ro_sB9TM

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-akamai-request-id: 9e0144d8.6acd6037
date: Tue, 21 Nov 2023 15:00:49 GMT
x-bytefaas-request-id: 202311211500491257DBB3D769B6E802E3
x-tt-trace-tag: id=16;cdn-cache=miss;type=dyn
x-cache: TCP_MISS from a2-16-239-13.deploy.akamaitechnologies.com (AkamaiGHost/11.3.2-52183077) (-)
x-parent-response-time: 96,2.16.239.13
server-timing: cdn-cache; desc=MISS, edge; dur=88, origin; dur=8, inner; dur=5
content-length: 0
pragma: no-cache
server: nginx
x-tt-logid: 202311211500491257DBB3D769B6E802E3
x-cache-remote: TCP_MISS from a23-218-219-15.deploy.akamaitechnologies.com (AkamaiGHost/11.3.2-52183077) (-)
access-control-max-age: 86400
access-control-allow-methods: *
location: https://cm.g.doubleclick.net/pixel?google_nid=toutiao_usd&google_push=AXcoOmRg5YBmOvr4vhOQ-VEFERcZuNRu6oTI7liGFeFrFACM02BKvSkKlRFvip1JpISTN_fK0h-hgggWLWtmQYobqeEbFe-ro_sB9TM
x-bytefaas-execution-duration: 3.63
access-control-allow-origin: *
access-control-allow-credentials: true
x-gw-dst-psm: ad.union.pangle_web_traffic
x-tt-trace-host: 01782c1aa098d441e14c7848822c4a7ef035ca4356bbab9b7d40e735f7919a2b67e7631c1447966ca576b13dc0fa27b57efc6e149d91988443b09b18841b1a48fbb56aa6db7f63657170353138f3f302c686f61cf79d5115bd49f7a81fe135ad0567a3714bfe32cb1fe6e133db4d59009d
x-origin-response-time: 8,23.218.219.15
cache-control: max-age=0, no-cache, no-store
access-control-allow-headers: *
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame F39E 0
12 B 28ms
24ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IJTWXgQr_vCNJ2CI-fpVr8tAS-XTxUnDUBQ-iDiUJrpYIR5Y5mFfI5L_gxWDxCFUg_yMXfBg

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 dc_pre=CK7U4vGt1YIDFV3MOwIdDpMKeA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3079521783723.196
adservice.google.com/ddm/fls/z/ Frame 7E35 42 B
63 B 53ms
53ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CK7U4vGt1YIDFV3MOwIdDpMKeA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3079521783723.196

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK7U4vGt1YIDFV3MOwIdDpMKeA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3079521783723.196?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame D8CC 273 KB
91 KB 24ms
24ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

daf0348e4b54d1713837e2a5ba58ebeba9044701e5d8fe41c154dc9f8ffb84f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92853
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 9006 53 KB
19 KB 13ms
12ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=47795800099584704444550012515009&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:21 GMT
content-encoding: gzip
via: 1.1 9f88eecf68d9192420b110f5f3f14fd6.cloudfront.net (CloudFront)
last-modified: Wed, 01 Nov 2023 16:51:16 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32669
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: gQ1Cg8LMKoXdEKRqAMeHj4v20ixvyrYGtAxP0db787r3JqBm-fc9WQ==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 9006 3 KB
3 KB 9ms
9ms Image
image/png 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1700579149&Signature=CXEcZwmEtyzkFosY1xc2G9SN7AuV7FfXP26mX7n2lbZjNT9ZNz6UMttJv2auQa4HKKDr5esSTW~-0yze49tq4t4RUwIRFql0DVjxOmfqQ~n2AgVIHJhPkrlPhwMoJLs0gHK-yFbUCpFCmT8yLoI30ZcPRWzVcQlN8KIeXQYfzoYbnV~tGIxZb8W2C3jEJM7nbMfLLBhURLo1Dt8WUIk~C~XgBuWxkeca3ng6TSO-nJpMLNTtEYiPLV3GlpCtVI3HY-tmSSthDBnvEewraIhzsSKgkd6dO5DeB-3EtiZ1WHUHoySl4UXwrlukIHOa8gvbOdnF73NjzhDlpow-6orjsg__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 07:14:28 GMT
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 27982
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: cj0w74mExJHZDtdGJFWpObf5sGV_Lxk2uq8U122XGnN5Afo_gtUaEw==

GET
H/1.1 200
OK viewability Show response
hal90009.redintelligence.net/ Frame 8C7F 0
150 B 36ms
12ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/viewability?s=47795800099584704444550012515009&a=715e7a76&vb=m
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 link.html Show response
track.webgains.com/ Frame EDFF 2 KB
2 KB 81ms
81ms Script
text/html 13.42.237.35
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=83732900102600404444994012515005&nw=1
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.42.237.35 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-42-237-35.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: 7a1b9f86fb78afde99f52ed5ec4a1c1759b50da82bb99adb96bde2ebbc587483

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
last-modified: Tue, 21 Nov 2023 15:00:49 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Tue, 21 Nov 2023 15:01:49 GMT

GET
H3

200

activityi;dc_pre=CK_0-PGt1YIDFZzTOwIdo_UOmg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1801394099295.508 Show response
5994599.fls.doubleclick.net/ Frame 0D7D
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1801394099295.508?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CK_0-PGt1YIDFZzTOwIdo_UOmg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1801394099295.508?

391 B
238 B

70ms
70ms

Document
text/html

142.250.186.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CK_0-PGt1YIDFZzTOwIdo_UOmg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1801394099295.508?

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.134 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b637e1a412107eddd378118542a5e74760eed268aad11f715510afe40e5ebfe5

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:49 GMT
expires: Tue, 21 Nov 2023 15:00:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK_0-PGt1YIDFZzTOwIdo_UOmg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1801394099295.508?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90005.redintelligence.net/ Frame 51FD 7 KB
2 KB 34ms
12ms Document
text/html 138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.165 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 62f6b6cbdc581a5bc3ce9677c99bd44a66455d4c465256c8652c25bd01524b2b

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2120
Content-Type: text/html; charset=utf-8
Date: Tue, 21 Nov 2023 15:00:49 GMT
Expires: Tue, 21 Nov 2023 15:00:49 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C012 1 KB
643 B 14ms
14ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 62636
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 20 Nov 2023 21:36:53 GMT
etag: 48472445140208031
expires: Tue, 21 Nov 2023 21:36:53 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EDFF 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 51cc246945fc8d5c128bf4c328735ba9796000236f9c0f5a591e52d3d44d428d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 51FD 5 KB
682 B 23ms
22ms Stylesheet
text/css 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 21 Nov 2023 13:37:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 21 Nov 2023 15:00:49 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 51FD 17 KB
17 KB 41ms
13ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b4b239eba09e8485750d875f6896c5d3dd964b2d2527c147c0fa783ae46465a8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16983
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 51FD 16 KB
16 KB 40ms
13ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 59f31498d281202c276e09a063b5fcfb75c8b4c983bd8637a5acaa0db90dd68f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16513
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 51FD 13 KB
13 KB 42ms
12ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/1200x627.jpg
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 06ebb07a15c3a8b59cafbd9f66ec7eb33e776df722b0e3ff98bb38f100e53340

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13201
Vary: Accept-Encoding
Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C012
Redirect Chain

https://fksnk.com/cs/google?google_gid=CAESEGj6XsZ0W3OObwWfRGPH-rM&google_cver=1&google_push=AXcoOmSLh5xXLNfqWzxJbbSDvHC4sucAA9kH0NIuqhlDfjgdq8LrliZrVohmVnpGF_scZrvQBteDCUpzbYA9pD6SN0i7fQ3ryeiu
https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NkJFNzgzMkEwMThFRjNGOQ==

170 B
188 B

29ms
28ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NkJFNzgzMkEwMThFRjNGOQ==

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=fiksu&google_hm=NkJFNzgzMkEwMThFRjNGOQ==
date: Tue, 21 Nov 2023 15:00:50 GMT
content-language: en-US
content-type: text/html;charset=ISO-8859-1

GET
H2 200 sync
x.bidswitch.net/ Frame C012 43 B
145 B 16ms
9ms Image
image/gif 18.197.187.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEPwn_qxEh1IJH9ZtqsfSVkY&google_cver=1&google_push=AXcoOmRnczFKKOzNfYyhLwpjr8ZRygpdzR30xeiqLGSHE33ef9qOKhGB07w8qMNoD3VTpvZquvEnRMFMN2_FWCC41HZ3c9G-ZEW_
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.187.29 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-187-29.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 204 -
s.ad.smaato.net/c/n/// Frame C012 0
238 B 80ms
39ms Image
text/plain 2600:9000:224a:8800:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESED30yXrtxxPIe3I9VCf7gGc&google_cver=1&google_push=AXcoOmSoo1YxFaNZw2la3zrvJ1rZr8Ebm6zz2CHjEVsaS6c8a1X2AtWFHhqScC2Rig7goN4lYXV6FPiw-KU9yfCtCHkxtChovcfu
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:8800:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cache-control: no-cache, must-revalidate
via: 1.1 b628053fca1386b0c2ba37163842b26e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-P1
x-amz-cf-id: gkNvKCmbF5quwx1VCMkKearROrTP60AjeSQu8Huy2DMp9pcWpjZXkg==
x-cache: Miss from cloudfront

GET
H2 200 ebda
match.360yield.com/match/ Frame C012 43 B
198 B 44ms
33ms Image
image/gif 34.242.208.83
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.360yield.com/match/ebda?google_gid=CAESED5n5niuAvXSFEY4yj3JhUw&google_cver=1&google_push=AXcoOmT74l_hcYb09ARUJ9DE9qvF9lwb8f0tGtM8rvHbGBqFaqtZ04xh42zWeO5Hjnv9jc515tPzRUabtmC9S5vkDy5S9j5ydgLV
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.242.208.83 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-242-208-83.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:49 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C012
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEPKo-xnTDEiayqSCZF7fyQA&google_cver=1&google_push=AXcoOmR4rdStCHeR_w2VIOp1CcoRIUjXwRFdrZoII_8iNUvNzh3eT-7I1eOyO6Bzq4ByWRfA4ZTFkNFPk55QK2TUw4NiQXZL0dlj
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=AXcoOmR4rdStCHeR_w2VIOp1CcoRIUjXwRFdrZoII_8iNUvNzh3eT-7I1eOyO6Bzq4ByWRfA4ZTFkNFPk55QK2TUw4NiQXZL0dl...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDUwODYzNDA1NTg3ODY1MjE4Njc4Ng%3D%3D&google_push=AXcoOmR4rdStCHeR_w2VIOp1CcoRIUjXwRFdrZoII_8iNUvNzh3eT-7I...

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDUwODYzNDA1NTg3ODY1MjE4Njc4Ng%3D%3D&google_push=AXcoOmR4rdStCHeR_w2VIOp1CcoRIUjXwRFdrZoII_8iNUvNzh3eT-7I1eOyO6Bzq4ByWRfA4ZTFkNFPk55QK2TUw4NiQXZL0dlj

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDUwODYzNDA1NTg3ODY1MjE4Njc4Ng%3D%3D&google_push=AXcoOmR4rdStCHeR_w2VIOp1CcoRIUjXwRFdrZoII_8iNUvNzh3eT-7I1eOyO6Bzq4ByWRfA4ZTFkNFPk55QK2TUw4NiQXZL0dlj
date: Tue, 21 Nov 2023 15:00:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C012
Redirect Chain

https://b1sync.zemanta.com/usersync/googleopenbidding/?google_gid=CAESEGVhx_kRcz0rwo2tcp0hCSg&google_cver=1&google_push=AXcoOmQM_GpTQ6zwiHthUq0IsaEaW6ml4Xdx9Ss7oDIcTdy9F5JKhy_w0WKnljxWl-vMxrPqm6kj_...
https://b1sync.zemanta.com/usersync/googleopenbidding/?google_cver=1&google_gid=CAESEGVhx_kRcz0rwo2tcp0hCSg&google_push=AXcoOmQM_GpTQ6zwiHthUq0IsaEaW6ml4Xdx9Ss7oDIcTdy9F5JKhy_w0WKnljxWl-vMxrPqm6kj_...
https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmQM_GpTQ6zwiHthUq0IsaEaW6ml4Xdx9Ss7oDIcTdy9F5JKhy_w0WKnljxWl-vMxrPqm6kj_XimjXbbp-zoK1s7WaLplAmvzQ&google_hm=eGo4YTFfYUZwVE...

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmQM_GpTQ6zwiHthUq0IsaEaW6ml4Xdx9Ss7oDIcTdy9F5JKhy_w0WKnljxWl-vMxrPqm6kj_XimjXbbp-zoK1s7WaLplAmvzQ&google_hm=eGo4YTFfYUZwVEFHVGVhMHFLaDU=

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Nov 2023 15:00:50 GMT
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=outbrain_eb&google_push=AXcoOmQM_GpTQ6zwiHthUq0IsaEaW6ml4Xdx9Ss7oDIcTdy9F5JKhy_w0WKnljxWl-vMxrPqm6kj_XimjXbbp-zoK1s7WaLplAmvzQ&google_hm=eGo4YTFfYUZwVEFHVGVhMHFLaDU=
P3p: CP="We do not support P3P header."
Cache-Control: no-cache, no-store, must-revalidate
Content-Length: 242
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame C012 43 B
145 B 14ms
9ms Image
image/gif 18.197.187.29
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEAoCnYmXEDNKz1vM-LR1zWw&google_cver=1&google_push=AXcoOmQmGEltL7CssJpr_6on6SrPkgQTJY8rV2oAZV6BE7vgglPFcw8dEJxGfxKJIUGR7lpRb7pjB8wzUnsc_Zh4RUE-yE1RK8al
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.197.187.29 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-187-29.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C012 0
12 B 23ms
22ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KtH7T_Hrka8SzewJ1qM5OTGVRag4sw8w8PgZ2fSpJI-92S8IXA4yF-ESCYIHTPuzeZejvHEnA

Requested by

Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame EDFF 53 KB
19 KB 19ms
15ms Script
application/javascript 108.157.4.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=83732900102600404444994012515005&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.157.4.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-75.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 75b11328827bb635b369ee1f4c8e9dad82b7b609d5bfc736d8ce1994a6f4c03b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 05:56:21 GMT
content-encoding: gzip
via: 1.1 9f88eecf68d9192420b110f5f3f14fd6.cloudfront.net (CloudFront)
last-modified: Wed, 01 Nov 2023 16:51:16 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P2
age: 32669
x-amz-server-side-encryption: AES256
etag: W/"5d5bc5942e2e0a61b44429bb852bdc91"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: YCzQvmXT_uNEHJ1UEga3Dfqj4K8j6ZyQtmr_QlGV9EQ9Ugf4Z-Z3TA==

GET
H2 200 1x1.gif
cdn.track.production.webgains.team/7121/ Frame EDFF 85 B
436 B 15ms
12ms Image
image/gif 99.86.4.53
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1700579149&Signature=ddbr~Dx4XkqrT5vvIFB5zDB3EFlq3q8691tWVKxk3ZZrBBA5LUB2vmU6A8at1LGjb3KNGEMJGx2ipBNBDruORthMv8hx020SbbXrQkZyiSmICruiMHYbk0aJabJ9J75vmOiod7JPPfPF-Zx9GUzwSHdrRx5gPTFkbm~~4WDQyJvk--QIKl4iYGB0lWXNo81ySvFJe3Sfg8bXb1-2VXvN6xSBHW5HOn438cxGqjfORLYR7dS~tbImo81d~tkQ-lxrmBM8NkYCzvqIUe0iKriOWwuZdg9Vq39mFxiH-hYpxXu8Gvpsp-y6yTLCCNnssXi4OZgqZP8g4n7upOzX1oGbXQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
URL: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-53.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 21 Nov 2023 10:57:54 GMT
via: 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA6-C1
age: 14576
etag: "70af33d70b6810475aae19743c8c435b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/gif
accept-ranges: bytes
content-length: 85
x-amz-cf-id: 7n26ei0YZN8EplV-yAlNFm7QYW10TlnagRIKIJUQxC82R95EjEOHLg==

GET
H/1.1 200
OK viewability Show response
hal90005.redintelligence.net/ Frame 51FD 0
150 B 38ms
12ms Script
text/html 138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/viewability?s=83732900102600404444994012515005&a=2f9e794b&vb=m
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.165 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 51FD 14 KB
15 KB 15ms
14ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90005.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 20:50:19 GMT
x-content-type-options: nosniff
age: 324630
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 20:50:19 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 51FD 15 KB
15 KB 17ms
17ms Font
font/woff2 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90005.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 17 Nov 2023 09:02:57 GMT
x-content-type-options: nosniff
age: 367072
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 16 Nov 2024 09:02:57 GMT

GET
H3 200 dc_pre=CK_0-PGt1YIDFZzTOwIdo_UOmg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1801394099295.508
adservice.google.com/ddm/fls/z/ Frame 0D7D 42 B
63 B 56ms
54ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CK_0-PGt1YIDFZzTOwIdo_UOmg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1801394099295.508

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CK_0-PGt1YIDFZzTOwIdo_UOmg;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1801394099295.508?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 99ms
64ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231109&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

901a81ae20c6b80ea79ff4487b02e6de911182c5a5c6bcc16756cdb8015fe548

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12367
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 68CA 15 KB
6 KB 21ms
21ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=simcast.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.139.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:49 GMT
server: Kestrel
server-processing-duration-in-ticks: 1459205
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/ Frame 68CA
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=simcast.com&sn=ChromeSyncframe&so=3&topUrl=simcast.com&bundle=nXtm8V9uTzBUTjBQSHZNak5VUjNsJTJGZ0s4cTM3TnlDZlhBbGVlTWdiODZ6UEthYVFmVHFFaWVT...
https://mug.criteo.com/sid?cpp=jzur9HxZR0dJSU9UUzBjY2hxdzg1WkRTdWVQN1dhT2wvcGUwZnpVbHIwaGFiVXV4cHptMVdEZVhwRWlkM0ZXVEV6ekRmQmpUK3hNK0ZyajROdmNob1FNYVNPT0N3aWp0Wlg0ekhvZUhIUFVITGlFazJEQkhPZ1l4eGdNYy...

451 B
653 B

17ms
16ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=jzur9HxZR0dJSU9UUzBjY2hxdzg1WkRTdWVQN1dhT2wvcGUwZnpVbHIwaGFiVXV4cHptMVdEZVhwRWlkM0ZXVEV6ekRmQmpUK3hNK0ZyajROdmNob1FNYVNPT0N3aWp0Wlg0ekhvZUhIUFVITGlFazJEQkhPZ1l4eGdNYy9VNXptTmpreno5bDJjd2NHMG9mSms4eUh1dFJ6VlJyRlc0MWVwWm5UM1hha0FlZmhHWmV4S0g5dHRRUkk4RU9IQWdFaWttTVg4dXRMQVBtRHhldDlmL1JUNjYwSFA1ZmZBREpSWHFhOGhiMHBrcUdIaCtoaC9TRGhSUUg3MDYrYlh5YlVyZEFSQ3VPaURJMUtVcFl2L0RxTWxINnJIRzdXdk5SWWVsQTRoQnpFbDUvVkNrND18&cppv=2

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

462600c04852faf091d581b438bfa45af10ee4bb5baecaf6536711fca45e9bd2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 688125
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:49 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=jzur9HxZR0dJSU9UUzBjY2hxdzg1WkRTdWVQN1dhT2wvcGUwZnpVbHIwaGFiVXV4cHptMVdEZVhwRWlkM0ZXVEV6ekRmQmpUK3hNK0ZyajROdmNob1FNYVNPT0N3aWp0Wlg0ekhvZUhIUFVITGlFazJEQkhPZ1l4eGdNYy9VNXptTmpreno5bDJjd2NHMG9mSms4eUh1dFJ6VlJyRlc0MWVwWm5UM1hha0FlZmhHWmV4S0g5dHRRUkk4RU9IQWdFaWttTVg4dXRMQVBtRHhldDlmL1JUNjYwSFA1ZmZBREpSWHFhOGhiMHBrcUdIaCtoaC9TRGhSUUg3MDYrYlh5YlVyZEFSQ3VPaURJMUtVcFl2L0RxTWxINnJIRzdXdk5SWWVsQTRoQnpFbDUvVkNrND18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 331341
content-length: 0
expires: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 21 Nov 2023 15:00:50 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame EFF3 281 B
555 B 27ms
7ms Document
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/library/prebid/8.5.0_trade_desk_33accross_intentiq/prebid.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Tue, 21 Nov 2023 15:00:50 GMT
ETag: "280525-119-60930cbd3cec0"
Last-Modified: Thu, 02 Nov 2023 19:57:23 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 200
OK viewability Show response
hal900010.redintelligence.net/ Frame 58C7 0
150 B 40ms
14ms Script
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/viewability?s=42777500112678604444990012515010&a=1407fbac&vb=v
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900010.redintelligence.net/request_content.php?s=42777500112678604444990012515010&a=13b8bc82
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:50 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DCC3 42 B
64 B 52ms
52ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuXumVYNuHQCtgB1rM028o6KAo7Sf98DPDRwz9-6EAqswR9HX_iZ-rQwKA3X848ylth69ytNzfInb3CRF37YZO3Jsb3xzRRd65Po1RYwSEuPq5AeLze5abfAYs5M_1DjkY&sai=AMfl-YTF_HrEFWe4LJrjlLwVRYwr28I15LydF9IRAohsHpWgYqFHGKs4Dvz4611wIUlyvfTU7jw9TkggUBeVnETTCAOIlXTrewchNZGWy68jP4-cIMjpHHjyi9MhNZvaTI0vk9pWnDG099e4nJtXDw19&sig=Cg0ArKJSzMFAx795YfyYEAE&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&id=lidar2&mcvt=1364&p=310,315,560,1285&mtos=1364,1364,1364,1364,1364&tos=1364,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4147964202&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700578847783&rpt=1249&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame EFF3 46 KB
13 KB 22ms
22ms Script
text/html 184.30.22.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.22.30 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-22-30.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 4c7dea702fcc7f49a0c9896c80e2c246c179e05c9c59785b003598b5e1a3a9d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:50 GMT
Content-Encoding: gzip
Last-Modified: Tue, 21 Nov 2023 02:00:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=39645
Connection: keep-alive
Content-Length: 13229
Expires: Wed, 22 Nov 2023 02:01:35 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9006 42 B
64 B 52ms
51ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuJQDTiyMB-L8nTGTdaytCmpRqdRJynjYGEUFPKin4OSrh9ovQnCCC_6mCnWvClFJQsrCcahGoc4gXARKTrbzhoNUuSKH2MfZKbFsxcfv9Ej3tH6s6gqkJlcIKuGJNEVrI&sai=AMfl-YRPIJEoSN48mV6V6hL0A-tIM__HV1NVlOJyuzuHUb0yyDWO25sh6lx0waCLJzh6dDkHHehBqGQ0BtgJcapLtbIaaywnzVE0i2PoxZ2_hM9_HxHIC7BgtBqMRR7c5_iTDZGxmTTrY1k6IuY-xjrA&sig=Cg0ArKJSzG-xRXaBKGOIEAE&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&id=lidar2&mcvt=1321&p=1110,436,1200,1164&mtos=1321,1321,1321,1321,1321&tos=1321,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2910413312&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700578847819&rpt=1414&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 105ms
105ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf87fb32c41-FRA
date: Tue, 21 Nov 2023 15:00:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pqMh32KGxIbu1sLmD7lAMdp3c0BY4c%2F8S06Tt8XTSDhS0gXMaRhaDR8MHfEURnOpYdNgX3kKeNU5Z9nVhjpRiNXWPDL%2BELwiX0Qhtr5EdhwrGNQ%2BQPGobiGeVUCFpVgUjNWLJ4ygD6mpNZgjLwc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 109ms
109ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdf88fce2c41-FRA
date: Tue, 21 Nov 2023 15:00:50 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CWVKFxWl4h1oGxAkQ8mKO10LqVgthgfNcumC3k6xVpM3yj0yXaoVIwv0xdXkTxaAATwl6yo0LrVE29Rq3bIvKwEqfZ07NuZI13t8txwoF1RO0a6RXCgfRDrUYI42j0qPz5T52AChbSxFopYeg3o%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
262 B 111ms
111ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Suwl8yUz1ThM0QnIJitZb00RVmRziKaXFG3zrtbpWQkoApGg20%2BCN%2B1k0Sy5Cya%2B0ECDYGwbscBgFUp2K3dlXSegu9obnl%2B5%2B5uCJlT%2BW%2BtObAzdlLw3HdasUEUJ1jlHA7O6oSsy1trWKcXHWn4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf918872c41-FRA
content-length: 0

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
259 B 105ms
105ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IyakVFg2%2FGsUUuOR7aqawZgRMJOhMP12JboWv5hqDBJsTrb%2FC75S3Vq3GiHO%2B75DQfx7E9s587js6wJbowHuWmkARUelinVH6bUmdzJ8m8qEij4VwUkknrdUqQUUqyH1umonvTWFQ6KujUGuuvA%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdf9389e2c41-FRA
content-length: 0

GET
H2 200 inserts.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 127 KB
43 KB 27ms
26ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/inserts.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 462478cd501b11de6f111719b46b8c46375ffeba611413f99b1844814a19eec8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 0
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=l774MKiJBYfO59S28Ja7QUKxRzodt%2B6jQd2VXlNjbKO92dDmnAqcVy4XVPg%2FfNkf%2F5OfjSzc2kvdYDLOfiHpRNUpzmiRnjOCLmUgMq1%2FA8E2Wzb5pjkCEH%2Bh3cZ51qVbzXFEtujLCEuxMnDC"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdf88b2d9170-FRA

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 208ms
72ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:50 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 046F 16 B
209 B 442ms
441ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK viewability Show response
hal90009.redintelligence.net/ Frame 8C7F 0
150 B 48ms
13ms Script
text/html 138.201.63.149
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90009.redintelligence.net/viewability?s=47795800099584704444550012515009&a=715e7a76&vb=v
Requested by: Host: hal90009.redintelligence.net
URL: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.149 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.149.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90009.redintelligence.net/request_content.php?s=47795800099584704444550012515009&a=f68c19a3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:50 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 5142 16 B
209 B 76ms
75ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 046F 0
20 B 47ms
46ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5302387532144&version=m202309260101&ct=77&x=1&cor=1669276969057030100

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5142 0
20 B 46ms
46ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=687316808538&version=m202309260101&ct=77&x=1&cor=7964317497358542000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal90005.redintelligence.net/ Frame 51FD 0
150 B 41ms
15ms Script
text/html 138.201.63.165
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90005.redintelligence.net/viewability?s=83732900102600404444994012515005&a=2f9e794b&vb=v
Requested by: Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.165 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.165.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90005.redintelligence.net/request_content.php?s=83732900102600404444994012515005&a=8012966e
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Tue, 21 Nov 2023 15:00:50 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame DCC3 16 B
209 B 72ms
71ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 129ms
22ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:50 GMT
server: nginx

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 43ms
23ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:50 GMT
server: nginx

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DCC3 0
20 B 49ms
49ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6586314330360&version=m202309260101&ct=77&x=1&cor=2944434094795118600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame EDFF 42 B
64 B 52ms
51ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvC6plhA5TaxVsxvlwJPi1ALuSSAv6xiH9EWuJRIDl-JgIAO95dXLo8bNf-ashX3JjN8x-w6dT5f5f_TzFwrrmZuuIuTHPO91HGOEPtyXzP2b_yzhwDxiN6eP1JNut7w7k&sai=AMfl-YQYwY_YhGRioq1INfs-otA59j84IrFTx2M-AZXuwUOjrIArCnMynC8_S2dwAn6-nRLyPp00RYAze-ewCh25UuPu8hxdGTLD4Koybu13ahVjKQQFsjcxtX5Nm-ZHY5PsPVywT91oxMdcpMTZHHY6&sig=Cg0ArKJSzEFJttWH5VpNEAE&cid=CAQSTgDICaaNWMB2X-dA6CadL6M6oZu3yV_b7ydk4Zk4Be2FreW1VNwcp4e_S61BV1rr5v8Zk6XIOjbZHGiPQWIjYk1oVz4UWqE1YWeQT7KFOxgB&id=lidar2&mcvt=1166&p=655,1232,935,1568&mtos=1166,1166,1166,1166,1166&tos=1166,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2595414818&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1700578847813&rpt=1783&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9006 0
20 B 47ms
46ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9567956802388&version=m202309260101&ct=77&x=1&cor=8479604203345502000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8769 13 KB
5 KB 22ms
20ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1438
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 14:36:52 GMT
expires: Wed, 20 Nov 2024 14:36:52 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 5380 829 B
1 KB 30ms
28ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

5a1085ee12c6d337c2fa4d5691358d52c2824726bee653e8e57caa27689eea8b

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ej8zefAgCHfejcmq6hC-Ig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-ej8zefAgCHfejcmq6hC-Ig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 21 Nov 2023 15:00:50 GMT
expires: Tue, 21 Nov 2023 15:00:50 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 9006 16 B
209 B 64ms
64ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 30ms
29ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:50 GMT
server: nginx

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame EDFF 16 B
209 B 915ms
913ms Fetch
application/json 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 22ms
21ms Preflight 13.43.195.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.43.195.94 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-13-43-195-94.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Tue, 21 Nov 2023 15:00:50 GMT
server: nginx

GET
H/1.1 200
OK khaos.json Show response
token.rubiconproject.com/ Frame EFF3 7 B
380 B 47ms
13ms XHR
application/json 69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://token.rubiconproject.com/khaos.json?
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: 81c2cbe50044dac07e1ac9ea9841ac415bdc38dd2f6b915ab044bf69ee71c628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://eus.rubiconproject.com
Cache-Control: no-cache,no-store,must-revalidate
access-control-allow-credentials: true
content-length: 7
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
Expires: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EDFF 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8993595916137&version=m202309260101&ct=77&x=1&cor=8024944143517269000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://622fbaf7e120c855b9e0f94bed4648dd.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Nov 2023 15:00:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 5380 0
0 51ms
50ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231109&jk=2571529057896910&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H2 200 p-64ee7c76.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 5 KB
2 KB 16ms
16ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-64ee7c76.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: fc671afb0fb4f987fdba2d42d1712fa4fbddb7f593d6b9ef3a08bf62cfe8ebaa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:13:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 0
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xFzPw61gcKY3z6auufrTFU3PP5PveuGF24tODRh5O0l1ochW0sdeRo0WBP8ggZ5ZdLq%2FrExMVGDpJ1SFFLEG6MPFiJdHpEQc%2FYZfVU6U8QeJIZmW%2BafQSVGLeWmeuVVVad9zRLEz3YTvsWIJ"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdfa7e0f9170-FRA

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 8769 39 KB
15 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 14:36:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1438
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 20 Nov 2024 14:36:52 GMT

GET
H2 200 p-519aaece.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 18 KB
7 KB 20ms
18ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-519aaece.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 7de421f5fc292856d86cd03dba3ad6bab58657ea6c554221445a834e5fa09649

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:50 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:13:12 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 0
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eRs9t3CSOFYe%2B0cDRFoVzFZLGNHuB%2BxO9N%2B8qh2FcarEgsetORaPtLyrJSD50CP8u9%2BxOmi0gVEvZaQ4CahHgCJFeyzmfqcXevhO1dVi7%2F8ct7Me8ZwfEJZNPZ0Qi%2Bad76yKicW6S0uozzVB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdfa9e3f9170-FRA

GET
H2 200 p-6de0ca0d.system.entry.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 56 KB
14 KB 391ms
390ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-6de0ca0d.system.entry.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 712be1d0391b49ad1764f0a469f88012719b49d17d195f2a8482c7c73d556fa2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
content-encoding: br
cf-cache-status: EXPIRED
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7QIL2w4KtDpfBLZmdZAM6rpDbwBN1wO4TUsHspl%2B81YK3t4TI0I7JYqBnb6Nj9znxVxLTxHP39wReKBsuQVX7a8RTK5%2FQ0dCw00q4ue67Iv9JpzQ%2BfOa8YLagHDg8EwkGDTKxLwrfJFiuoZh"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdface889170-FRA

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8769 0
10 B 13ms
13ms Image
text/plain 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?ltjOzg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 p-75fe082c.system.js Show response
tags.qortex.ai/components/inserts/dist/inserts/ 113 KB
40 KB 18ms
18ms Script
application/javascript 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.qortex.ai/components/inserts/dist/inserts/p-75fe082c.system.js
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/cx-overlay.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 27957e60720cb638a200617a862829f7de781662b0872d8632172ee14d224364

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Nov 2023 15:16:04 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 118
etag: W/"119"
x-powered-by: Express
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=apOP6aMn%2BcC0EcwwDmohveP6K6c%2BUFJfpNu4dK2w1VBdzol2a%2BQ07vT5tfBnQJC93sEh8Xr3cNw%2FQwXqx5wJxX%2BT5AFEtYWIeCU814E3GbqP2pa9i%2BFvlPWz4r81rQI7qz%2F472KN1CN3R89K"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=14400
cf-ray: 8299cdfd399c9170-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 102ms
102ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdfd8d7e2c41-FRA
date: Tue, 21 Nov 2023 15:00:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Sa63pbV3%2BjFrOBbvXyvLIPLxMR3Ym3K%2FYr7pC0h9kEyGOPJ7jWPviyjm%2BLuvhnr7%2B1Edrea%2B5EZvrQVN9OkxU73Qe9zAqHa1TPhsxjL2PrEDPDMf7UEv4BBxd%2F5nwyUvNJsPkE%2FJzu8OHaYaCT0%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
260 B 108ms
108ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xg1wBRXz50iwKxlRixzXqhI%2FqIhL7kXarKTO2c%2Bwla8htAOevftrhlQT4uFbb4Zl0j%2FVRL4GqE1wntvyIk4xAT3NEvTBRMpa9Kn50qdYdLS7rQ4bHuOFznfd5t43zVD4aWAZd7C%2Bk0VbFBBJDcc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdfe2e3c2c41-FRA
content-length: 0

GET
H2 200 Generic-BugFlip.png
tags.qortex.ai/assets/inserts/shared/common_images/ 407 B
734 B 15ms
15ms Image
image/png 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/Generic-BugFlip.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 92ef728984670149848a09c8a589b1ca470fe602065dee127c26a0dcab2115a5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 118
x-powered-by: Express
content-length: 407
last-modified: Wed, 15 Nov 2023 15:15:53 GMT
server: cloudflare
etag: W/"119"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RXD%2B7tZi2JNNln63tb3smJF34sS%2B2hFMzHI6w17k3UMtGGy%2FkD2HCTAyR1K8IzH4p7NiyZMacCmg%2FmWPmZM7dIu7vMOMwDW%2FwoFFwkp%2FLAXtHNu34xODvNcbCSZsry7a%2FZG%2Bm709235ACDZ2"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8299cdfd99fb9170-FRA

GET
H2 200 PNG_CloseButtonOutline.png
tags.qortex.ai/assets/inserts/shared/common_images/ 1 KB
1 KB 18ms
17ms Image
image/png 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/PNG_CloseButtonOutline.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 430cc3198a26a9b7438c95aeb5ff9ae90437059a690cdd1287c57070f52d2982

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 118
x-powered-by: Express
content-length: 1080
last-modified: Wed, 15 Nov 2023 15:15:53 GMT
server: cloudflare
etag: W/"119"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M2tQ%2F%2FIocUPNGHBhENEZRNtycK%2BjOEcOB18%2FXw6F0qHQ%2Fc1artCOvdMF7O8RC4mg3jJXThsWHNCWnkKWrEueDd3X7sG9mHrXaG6xUuNT%2FtMYjg82Xf%2F1MAqYuvz6lNTdCWjkw%2BcM%2Fo%2FtRbti"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8299cdfd99fc9170-FRA

GET
H2 200 PNG_CloseButtonBackground.png
tags.qortex.ai/assets/inserts/shared/common_images/ 554 B
841 B 18ms
18ms Image
image/png 2606:4700:20::681a:13e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.qortex.ai/assets/inserts/shared/common_images/PNG_CloseButtonBackground.png
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:13e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 9e399906113e82fdca498a58d00013adda68308481605fcae2d488772559425f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 118
x-powered-by: Express
content-length: 554
last-modified: Wed, 15 Nov 2023 15:15:53 GMT
server: cloudflare
etag: W/"119"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IgLAxRk20rlFPahhwEQygdVuUav6fQ4PVPnDQGNq4WCo%2FAubjjv4jhwKhyfCkDTd5Qh%2F6DygNrmBS0emkECJb42EeYjtADSYw3psX3q9HSRIUWvExL5jVZOWxksFrhGU1SQ%2BEnxv%2Fl3OGzFS"}],"group":"cf-nel","max_age":604800}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=14400
accept-ranges: bytes
cf-ray: 8299cdfd99fd9170-FRA

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 131ms
131ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdfe6e842c41-FRA
date: Tue, 21 Nov 2023 15:00:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AXN%2FDkgZ7mZGWfzwpGa2CM1q5f5MGBr%2FTmLJYl4KhT2aIEMyZH0HzN%2B2ETQC%2Fgo%2F73POoA5kL%2FOPjc3H8csNWs5TglroxNRXvs1jQIM9Rt35vkYpdQ9xivwa9ziMZSV4gw234AKDMCRxmDSaLmY%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 104ms
104ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdfe7e992c41-FRA
date: Tue, 21 Nov 2023 15:00:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=go5dDKf9SdejTCX%2BTAcgAcn2h68g0dx2afSq5TuX8KQGk3OHMBId3X7v7VdpYh9LXUOJpQ%2BRM9GPgCJGsMxGFxrKy4XH8M9OF1CCpoCko%2FieZwl7wG%2FTUFrJ4djo%2BPaDUuOqIaB3mmvccP0iomw%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
258 B 107ms
107ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jv02CEuCbghMEcmo7Xscl3bSmwAHZB7IUhVkBrGbEVSnSl6lHdUpxyt7zqA%2FjPDcpTcz1mSCylu62z0vgsv%2F2n03cXSCiqHSgMjwZ54hlbCLTwGsH5Ks9MmHOpdd1hvPv00uLWiZP%2FmsZhWZ4Dc%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdff3fb42c41-FRA
content-length: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 54 KB
13 KB 351ms
350ms Fetch
text/plain 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2571529057896910&correlator=3520640962818187&eid=31079630%2C31079659%2C31079723%2C31079525&output=ldjh&gdfp_req=1&vrg=202311090101&ptt=17&impl=fifs&iu_parts=22181265%2Csmc_cx-on-stream&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90&ifi=7&sfv=1-0-40&sc=1&cookie=ID%3D9f86d3e1158216dc%3AT%3D1700578847%3ART%3D1700578847%3AS%3DALNI_MYSK8-YYSvt85jwPt5D2AUkSPnqrw&gpic=UID%3D00000cd68f49e13e%3AT%3D1700578847%3ART%3D1700578847%3AS%3DALNI_MZw8wrIOeiqXQAtJWI5TVzIn96RMg&abxe=1&dt=1700578851585&lmt=1700578851&adxs=20&adys=655&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dfoxwebapps.com%26pcid%3D48%26rid%3D112%26a%3D0&ref=http%3A%2F%2Fsupport.foxwebapps.com%2F&vis=1&psz=760x-1&msz=760x-1&fws=4&ohw=760&ga_vid=1645018742.1700578846&ga_sid=1700578846&ga_hid=902822427&ga_fc=true&a3p=EhsKDDMzYWNyb3NzLmNvbRil1JeTvzFIAFICCG8SGAoJeWFob28uY29tGJ7Tl5O_MUgAUgIIbxIZCgp1aWRhcGkuY29tGPfSl5O_MUgAUgIIbxIbCgxpZDUtc3luYy5jb20Y9tKXk78xSABSAghvEhwKDWNyd2RjbnRybC5uZXQY9tKXk78xSABSAghvEjsKCnB1YmNpZC5vcmcSJDkyZmVjMjBjLWIyNzMtNGM0Mi1iMTc0LTk1NDQwMTViMDlkNRj00peTvzFIABIdCg5lc3AuY3JpdGVvLmNvbRje0peTvzFIAFICCGQSggIKCHJ0YmhvdXNlEuwBZ0hXRXlOMUZwV3Q3azFVR3pIMHlqZFhyUXA1UkxtU1RNRjhUM3NIYTZSKzJUMU1JVXZiZXhLZmRLQU5kYm1uVU9QNDZCYkt6b0R3SEJMeXBnZm5TZHptWm9RYU9zM01ubW5uaTFXclYwb0hHTXh6TEl2MjhNQXgrUW1HK2c2WklyakpIQktrR01Tc2psUG9oWjhPM2c4L015YlhFbFpJR0g2ajQrUkJhdXZPN3lZVnl1Sk8wa0VPaGdpOXFyWENTNmtRYmZOcFo2d20xMVJBSWx4SkVmWXhhZGFES0dqdTNVc2tyL08yTVRLcz0YktSXk78xSAASPgoFb3BlbngSLGV5SnBJam9pWkhKS1dqbGthRXBTY1hWMlNtZG5NMUI0Tm5sRlFUMDlJbjA9GNvVl5O_MUgAEhsKDGxpdmVyYW1wLmNvbRj20peTvzFIAFICCG8SHQoObGl2ZWludGVudC5jb20Y9tKXk78xSABSAghv&dlt=1700578844806&idt=1301&ppid=92fec20cb2734c42b1749544015b09d5&cust_params=gcRTDTest%3Dtrue%26pbstck_ab_test%3Dtrue%26wvr%3D3%26wie%3Dtop%26cndl%3D10%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D500%26wrap_l%3D1600%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D200%26padpr%3D20%2633acrossId%3Dfalse%26amxId%3Dfalse%26criteo%3Dfalse%26hadronId%3Dfalse%26id5Id%3Dfalse%26identityLink%3Dfalse%26liveIntentId%3Dfalse%26lotamePanoramaId%3Dfalse%26pairId%3Dfalse%26quantcastId%3Dfalse%26sharedId%3Dtrue%26teadsId%3Dfalse%26uid2%3Dfalse%26uids%3Dpubcid%26uids_c%3D1%26waai%3D500%26gc_bucket%3DH%26waae%3D900%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D1s%26pad%3D19&adks=577197519&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fd8e45ab5275c663a0824546051d62ae882b265d54054393b557151c566e36dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13457
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
258 B 123ms
122ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jbx8TvZv4RZ1DSzU95YKqwc9V4uCCbueJtuRyOMz2RQ0N6Ak3A5Ef6WVow7rinaE%2BHkVdWa1PIOkpsRyW0DbZD4T1fS9Vd29rPd5SCRLYVfFW7jALr80fAJm6uWAFYguOSryWWVtkyUJp5PBio4%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdff1f812c41-FRA
content-length: 0

OPTIONS
H2 204 player-event
events.qortex.ai/api/v1/ Frame 0
0 211ms
210ms Preflight 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
cf-cache-status: DYNAMIC
cf-ray: 8299cdfe8ea62c41-FRA
date: Tue, 21 Nov 2023 15:00:51 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C5zezOeJawJsu4MwdT62MYnypF58zuxO4xS9kTIiLKpqF7%2BIVYUp3QvMdv1atG%2FISRDDJ2fJl4tQdcKqVyUIoRScntoYKtVODz98gCofE4Nl9Yq09zxoxfInKnf8ZTDKQEbj9Gr7Xyh62PnIBVc%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare

POST
H2 200 player-event Show response
events.qortex.ai/api/v1/ 0
262 B 102ms
102ms XHR
text/plain 2606:4700:20::681a:3e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://events.qortex.ai/api/v1/player-event
Requested by: Host: tags.qortex.ai
URL: https://tags.qortex.ai/cxo/p-5ce3b907.system.entry.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:3e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/plain, */*
Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 21 Nov 2023 15:00:51 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=51kb6BBYc9ilEZ%2BOcSNtH84HpKZ%2B5fIaTO07QL2M3bDQKdNCZjJ7sCUv5hc0Tl0HWT9jjvIwWz9AAlee5N%2FtPQTKCOVBRtPoyjVnBbLKQkvMVlcgGHPH4fuKGByMQ%2BmrlfcJtqDmo%2FR2ikfhZp8%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-origin: *
cf-ray: 8299cdffd8552c41-FRA
content-length: 0

POST
H2 204 prebid Show response
ib.adnxs.com/openrtb2/ 0
639 B 122ms
120ms Fetch 37.252.171.21
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/openrtb2/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS