whospendsmoney.com Open in urlscan Pro
35.209.232.31 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://whospendsmoney.com/
Submission: On April 11 via automatic, source certstream-suspicious (April 11th 2022, 7:25:17 pm UTC) — Scanned from DE

Summary HTTP 69 Redirects Links 23 Behaviour Indicators

Summary

This website contacted 14 IPs in 2 countries across 13 domains to perform 69 HTTP transactions. The main IP is 35.209.232.31, located in Council Bluffs, United States and belongs to GOOGLE-2, US. The main domain is whospendsmoney.com.
TLS certificate: Issued by R3 on April 11th 2022. Valid for: 3 months.

This is the only time whospendsmoney.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
24	35.209.232.31 35.209.232.31	19527 (GOOGLE-2) (GOOGLE-2)
2	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f02... 2a03:2880:f027:18:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
7	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
1	104.75.89.43 104.75.89.43	16625 (AKAMAI-AS) (AKAMAI-AS)
1	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
8	2a00:1450:400... 2a00:1450:4001:813::2001	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:812::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
69	14

24 35.209.232.31 (Council Bluffs, United States)

ASN19527 (GOOGLE-2, US)
PTR: 31.232.209.35.bc.googleusercontent.com

whospendsmoney.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

maxcdn.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f027:18:face:b00c:0:3 (Chicago, United States)

ASN32934 (FACEBOOK, US)

scontent-ort2-1.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.75.89.43 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-89-43.deploy.static.akamaitechnologies.com

www.fredmeyer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.66 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

static.xx.fbcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:813::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:812::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	whospendsmoney.com whospendsmoney.com	324 KB
18	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 98 tpc.googlesyndication.com — Cisco Umbrella Rank: 128	349 KB
8	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 343	148 KB
4	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 40	18 KB
3	google.com adservice.google.com — Cisco Umbrella Rank: 77 www.google.com — Cisco Umbrella Rank: 4	2 KB
2	google.de adservice.google.de — Cisco Umbrella Rank: 7579	914 B
2	fbcdn.net scontent-ort2-1.xx.fbcdn.net — Cisco Umbrella Rank: 4641 static.xx.fbcdn.net — Cisco Umbrella Rank: 589	7 KB
2	bootstrapcdn.com maxcdn.bootstrapcdn.com — Cisco Umbrella Rank: 682	83 KB
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	9 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 794	649 B
1	fredmeyer.com www.fredmeyer.com — Cisco Umbrella Rank: 43884
0	safeway.com Failed www.safeway.com Failed
0	albertsons.com Failed www.albertsons.com Failed
69	13

	Domain	Requested by
24	whospendsmoney.com	whospendsmoney.com
11	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
8	cdn.ampproject.org	googleads.g.doubleclick.net pagead2.googlesyndication.com
7	pagead2.googlesyndication.com	whospendsmoney.com pagead2.googlesyndication.com tpc.googlesyndication.com
4	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	maxcdn.bootstrapcdn.com	whospendsmoney.com maxcdn.bootstrapcdn.com
1	www.google.com	tpc.googlesyndication.com
1	static.xx.fbcdn.net	www.facebook.com
1	www.facebook.com	whospendsmoney.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	www.fredmeyer.com	whospendsmoney.com
1	scontent-ort2-1.xx.fbcdn.net	whospendsmoney.com
0	www.safeway.com Failed	whospendsmoney.com
0	www.albertsons.com Failed	whospendsmoney.com
69	16

This site contains links to these domains. Also see Links.

Domain
www.wincofoods.com
facebook.com
www.facebook.com
twitter.com
www.linkedin.com

Subject Issuer	Validity	Valid
*.whospendsmoney.com R3	`2022-04-11` - `2022-07-10`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-01-29` - `2023-01-29`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-01-19` - `2022-04-19`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-03-21` - `2022-06-13`	3 months	crt.sh
www.kroger.com Sectigo RSA Organization Validation Secure Server CA	`2021-11-18` - `2022-11-18`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-03-21` - `2022-06-13`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-03-21` - `2022-06-13`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-03-21` - `2022-06-13`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2022-03-21` - `2022-06-13`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-03-21` - `2022-06-13`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-03-21` - `2022-06-13`	3 months	crt.sh

This page contains 8 frames:

Primary Page: https://whospendsmoney.com/
Frame ID: E0D566B853A17FD4704FBA102749A24B
Requests: 43 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2632348965707588&output=html&h=600&slotname=8546813212&adk=1432103522&adf=4164437415&pi=t.ma~as.8546813212&w=120&lmt=1649705107&url=https%3A%2F%2Fwhospendsmoney.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649705107584&bpp=30&bdt=697&idt=235&shv=r20220406&mjsv=m202203300101&ptt=5&saldr=sa&abxe=1&correlator=6394441549083&frm=20&pv=2&ga_vid=1787799220.1649705108&ga_sid=1649705108&ga_hid=2067439772&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=959&ady=1362&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760474%2C31065544&oid=2&pvsid=1804878536849812&pem=810&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cebr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=51gjc7Emlg&p=https%3A//whospendsmoney.com&dtd=281
Frame ID: 47B3D1EED540F5408AD76493021B55BF
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2F167132510135830%2F&tabs&width=300&small_header=&adapt_container_width=true&hide_cover=&hide_cta=&show_facepile=&locale=en_US
Frame ID: F6D27F572AEC4AAB1287CF9B71015BFC
Requests: 2 HTTP requests in this frame

Frame: https://cdn.ampproject.org/v0/amp-form-0.1.js
Frame ID: 3A2A495AA28D8BB08DF3F020F9BBE8B8
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220406/r20190131/zrt_lookup.html
Frame ID: 40670D63980DDF378998A147DF04474F
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2632348965707588&output=html&adk=1812271804&adf=3025194257&lmt=1649705109&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwhospendsmoney.com%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649705109580&bpp=2&bdt=2693&idt=2&shv=r20220406&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dba075840cc54086e-22fcbffc74cd00bf%3AT%3D1649705107%3ART%3D1649705107%3AS%3DALNI_MZocIkSLrLJl_RgiozVizmBG-vokg&prev_slotnames=8546813212&nras=1&correlator=6394441549083&frm=20&pv=1&ga_vid=1787799220.1649705108&ga_sid=1649705108&ga_hid=2067439772&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760474%2C31065544&oid=2&pvsid=1804878536849812&pem=810&tmod=1852542626&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=34
Frame ID: A10A417798C836929523351A0B5D3C00
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 1A3535388EE60A419D4EC454B2F655DA
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 61660ACA88A84335B88E4764DC52FFB6
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AMP (JavaScript frameworks) Expand

Overall confidence: 100%
Detected patterns

<link rel="amphtml"

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -

DoubleClick Ad Exchange (AdX) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/pagead/show_ads\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
<link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

69
Requests

96 %
HTTPS

77 %
IPv6

13
Domains

16
Subdomains

14
IPs

2
Countries

941 kB
Transfer

2207 kB
Size

2
Cookies

23 Outgoing links

These are links going to different origins than the main page.

URL: https://www.wincofoods.com/coupons#/
Title: $1/1 Darigold 2lb Medium Cheddar Cheese Coupon

Search URL Search Domain Scan URL

URL: https://facebook.com/167132510135830
Title: Who Spends Money?

Search URL Search Domain Scan URL

URL: https://www.facebook.com/167132510135830
Title: Who Spends Money? updated their business hours.

Search URL Search Domain Scan URL

URL: https://www.facebook.com/167132510135830/posts/1394463867402682
Title: View on Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.facebook.com%2F167132510135830%2Fposts%2F1394463867402682
Title: Share

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.facebook.com%2F167132510135830%2Fposts%2F1394463867402682
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.facebook.com%2F167132510135830%2Fposts%2F1394463867402682&title=
Title: Share on Linked In

Search URL Search Domain Scan URL

URL: https://www.facebook.com/167132510135830_1353596864822716
Title: View on Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1353596864822716
Title: Share

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1353596864822716
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1353596864822716&title=%09%09%09%243.98%20Darigold%202lb%20Medium%20Cheddar%20Cheese%20%40%20Wincowhospendsmoney.com%2F3-98-darigold-2lb-medium-cheddar-cheese-winco%2F%09%09%09%09
Title: Share on Linked In

Search URL Search Domain Scan URL

URL: https://www.facebook.com/WhoSpendsMoney/photos/a.175926209256460/1341743526008050/?type=3
Title: Photo

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.facebook.com%2FWhoSpendsMoney%2Fphotos%2Fa.175926209256460%2F1341743526008050%2F%3Ftype%3D3
Title: Share

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.facebook.com%2FWhoSpendsMoney%2Fphotos%2Fa.175926209256460%2F1341743526008050%2F%3Ftype%3D3
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.facebook.com%2FWhoSpendsMoney%2Fphotos%2Fa.175926209256460%2F1341743526008050%2F%3Ftype%3D3&title=%09%09%09FREE%20Glad%20Wrap%20or%20Press%20n%20Seal%20Wrap%20%40%20SafewayThis%20week%20in%20the%20Oregon%20area%20is%20a%20%240.99%20Glad%20wrap%20OR%20Press%20n%20seal%20wrap%20J4U%20couponsThere%20is%20also%20a%20loadable%20%241%2F1%20Glad%20wrap%20or%20press%20n%20seal%20MQ%21They%20work%20perfectly%20together%2C%20%3D%240.01%20overage%2C%20which%20the%20register%20takes%20care%20of%20everything%21Nice%20time%20to%20stock%20up%20%28if%20you%20have%20more%20than%20one%20card%21%21%29%09%09%09%09
Title: Share on Linked In

Search URL Search Domain Scan URL

URL: https://www.facebook.com/167132510135830_1322418967940506
Title: View on Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1322418967940506
Title: Share

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1322418967940506
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1322418967940506&title=%09%09%09Safeway%20%26amp%3B%20Albertsons%20Weekly%20Deal%20Summary%2009%2F18%2F19%20-%2009%2F24%2F19whospendsmoney.com%2Fsafeway-albertsons-weekly-deal-summary-09-18-19-09-24-19%2F%09%09%09%09
Title: Share on Linked In

Search URL Search Domain Scan URL

URL: https://www.facebook.com/167132510135830_1297486217100448
Title: View on Facebook

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1297486217100448
Title: Share

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1297486217100448
Title: Share on Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.facebook.com%2F167132510135830_1297486217100448&title=%09%09%09Safeway%20%26amp%3B%20Albertsons%20Weekly%20Deal%20Summary%2008%2F21%2F19%20-%2008%2F27%2F19whospendsmoney.com%2Fsafeway-albertsons-weekly-deal-summary-08-21-19-08-27-19%2F%09%09%09%09
Title: Share on Linked In

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

69 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
whospendsmoney.com/ 126 KB
20 KB 659ms
247ms Document
text/html 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cc7d61a19e29d0eab07de4437d2fa2b0af07050a408d0db174c166a3c220a4b6

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 11 Apr 2022 19:25:06 GMT
host-header: 8441280b0c35cbc1147f8ba998a563a7
link: <https://whospendsmoney.com/wp-json/>; rel="https://api.w.org/"
server: nginx
vary: Accept-Encoding
x-cache-enabled: True
x-httpd: 1
x-proxy-cache: HIT

GET
H2 200 fpw_styles.css
whospendsmoney.com/wp-content/plugins/feature-a-page-widget/css/ 1 KB
860 B 154ms
146ms Stylesheet
text/css 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-content/plugins/feature-a-page-widget/css/fpw_styles.css?ver=2.1.0
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 59b00ee3ac3a3aaa1d45426d750e7142dde36965ac18a61c83ac2433f62550ec

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Wed, 12 Aug 2020 23:26:24 GMT
server: nginx
etag: W/"5f347aa0-5c8"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: text/css
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 style.min.css
whospendsmoney.com/wp-includes/css/dist/block-library/ 81 KB
10 KB 158ms
152ms Stylesheet
text/css 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-includes/css/dist/block-library/style.min.css?ver=02675037ba6757ce19137b9d0b4cb88a
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Wed, 06 Apr 2022 06:40:12 GMT
server: nginx
etag: W/"624d35cc-145db"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: text/css
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 styles.css
whospendsmoney.com/wp-content/plugins/contact-form-7/includes/css/ 3 KB
1 KB 170ms
165ms Stylesheet
text/css 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.5.6
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Thu, 24 Feb 2022 07:31:44 GMT
server: nginx
etag: W/"62173460-aab"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: text/css
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 cff-style.css
whospendsmoney.com/wp-content/plugins/custom-facebook-feed/assets/css/ 21 KB
3 KB 182ms
176ms Stylesheet
text/css 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-content/plugins/custom-facebook-feed/assets/css/cff-style.css?ver=4.1.2
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 47be67fc4ce329ea0d01e275139dc53c376b3a55cd09cbf45f89d39890a847bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Thu, 24 Feb 2022 07:31:37 GMT
server: nginx
etag: W/"62173459-5535"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: text/css
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 30 KB
7 KB 480ms
33ms Stylesheet
text/css 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css?ver=02675037ba6757ce19137b9d0b4cb88a

Requested by

Host: whospendsmoney.com
URL: https://whospendsmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723
age: 129444
cdn-cachedat: 03/12/2022 14:32:07
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver: 1.02
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
etag: W/"269550530cc127b6aa5a35925a7de6ce"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 27aabc5ece0ec4e2ede6348fd7d51c48
cf-ray: 6fa61b392cc29b55-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
whospendsmoney.com/wp-includes/js/jquery/ 87 KB
30 KB 206ms
201ms Script
application/javascript 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Mon, 09 Aug 2021 06:40:48 GMT
server: nginx
etag: W/"6110cdf0-15db1"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: application/javascript
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 jquery-migrate.min.js Show response
whospendsmoney.com/wp-includes/js/jquery/ 11 KB
4 KB 283ms
278ms Script
application/javascript 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Wed, 09 Dec 2020 20:05:02 GMT
server: nginx
etag: W/"5fd12dee-2bd8"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: application/javascript
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 DD_roundies.js Show response
whospendsmoney.com/wp-content/themes/atahualpa/js/ 16 KB
5 KB 283ms
279ms Script
application/javascript 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-content/themes/atahualpa/js/DD_roundies.js?ver=0.0.2a
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f6d3ae7ad953291efcbfd5cb7b88a931d55231037419b1c406682c7a8e8d1e93

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Fri, 16 Nov 2012 04:17:27 GMT
server: nginx
etag: W/"50a5be57-41d5"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: application/javascript
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 logo2.png
whospendsmoney.com/wp-content/themes/atahualpa/images/ 16 KB
17 KB 258ms
256ms Image
image/png 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/themes/atahualpa/images/logo2.png
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1efd2d1ec9705fca24e54f5c961bc092eb6fb995cbe3912a44cdef4613b217a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Fri, 16 Nov 2012 05:27:00 GMT
server: nginx
etag: "50a5cea4-41cf"
x-proxy-cache-info: DT:1
content-type: image/png
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 16847
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 comment-gray.gif
whospendsmoney.com/wp-content/themes/atahualpa/images/icons/ 155 B
383 B 259ms
256ms Image
image/gif 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/themes/atahualpa/images/icons/comment-gray.gif
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 388ab7222ffb7a76088a7a12dd3529aeb4f3a3b0f2c207eeda623a0f0d5d9192

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Fri, 16 Nov 2012 04:17:27 GMT
server: nginx
etag: "50a5be57-9b"
x-proxy-cache-info: DT:1
content-type: image/gif
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 155
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 folder-gray.gif
whospendsmoney.com/wp-content/themes/atahualpa/images/icons/ 164 B
392 B 259ms
257ms Image
image/gif 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/themes/atahualpa/images/icons/folder-gray.gif
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4f7f54ecb04d7f9918c84c70d741fd31219f04c2b73553109e155a3b9b23719e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Fri, 16 Nov 2012 04:17:27 GMT
server: nginx
etag: "50a5be57-a4"
x-proxy-cache-info: DT:1
content-type: image/gif
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 164
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 1013937_167134133469001_1177450756_n.jpg
scontent-ort2-1.xx.fbcdn.net/v/t1.18169-1/ 1 KB
2 KB 376ms
112ms Image
image/jpeg 2a03:2880:f027:18:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://scontent-ort2-1.xx.fbcdn.net/v/t1.18169-1/1013937_167134133469001_1177450756_n.jpg?stp=c14.14.172.172a_cp0_dst-jpg_s50x50&_nc_cat=105&ccb=1-5&_nc_sid=dbb9e7&_nc_ohc=WK9-pNdcQu4AX8lqUsD&_nc_ht=scontent-ort2-1.xx&edm=AKIiGfEEAAAA&oh=00_AT8TXEPJF8a8J0Rjal_hr-pK8Qo_6i-TtgeXmzXCVj4C9Q&oe=627B36D0
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f027:18:face:b00c:0:3 Chicago, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 3aabb33f726a685a62ff6d203087192d97c986c3190ac642d26fbf5465ef27bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-haystack-needlechecksum: 2212772978
date: Mon, 11 Apr 2022 19:25:07 GMT
x-fb-trip-id: 1781455057
last-modified: Thu, 11 Jul 2013 04:58:45 GMT
content-type: image/jpeg
access-control-allow-origin: *
content-digest: adler32=3869220921
cache-control: max-age=1209600, no-transform
cross-origin-resource-policy: cross-origin
x-needle-checksum: 2517201707
timing-allow-origin: *
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1392

GET
H2 200 magnifier2-gray.gif
whospendsmoney.com/wp-content/themes/atahualpa/images/ 419 B
647 B 259ms
257ms Image
image/gif 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/themes/atahualpa/images/magnifier2-gray.gif
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: bd4f5bcac3650d2778bd48496d62be3d6fbd0922701405afa0df28bd19c5c3fd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Fri, 16 Nov 2012 04:17:27 GMT
server: nginx
etag: "50a5be57-1a3"
x-proxy-cache-info: DT:1
content-type: image/gif
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 419
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ 115 KB
40 KB 228ms
70ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: whospendsmoney.com
URL: https://whospendsmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

43d57fbb7bff94a1c232195530c60c873e51f8d214628e4711509cae84ac21a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40147
x-xss-protection: 0
server: cafe
etag: 16308314588388592139
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 19:25:07 GMT

GET
H2 200 regenerator-runtime.min.js Show response
whospendsmoney.com/wp-includes/js/dist/vendor/ 6 KB
3 KB 145ms
144ms Script
application/javascript 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Mon, 31 Jan 2022 18:26:46 GMT
server: nginx
etag: W/"61f829e6-195e"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: application/javascript
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 wp-polyfill.min.js Show response
whospendsmoney.com/wp-includes/js/dist/vendor/ 19 KB
7 KB 138ms
134ms Script
application/javascript 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Mon, 31 Jan 2022 18:26:46 GMT
server: nginx
etag: W/"61f829e6-4b3d"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: application/javascript
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 index.js Show response
whospendsmoney.com/wp-content/plugins/contact-form-7/includes/js/ 9 KB
3 KB 148ms
145ms Script
application/javascript 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.5.6
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 679e44f9b4bbbc2ad0c4000c1413fd3a88627d83f1cba8ebdac26f81bc7edb78

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Thu, 24 Feb 2022 07:31:44 GMT
server: nginx
etag: W/"62173460-25f8"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: application/javascript
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 cff-scripts.js Show response
whospendsmoney.com/wp-content/plugins/custom-facebook-feed/assets/js/ 53 KB
15 KB 161ms
158ms Script
application/javascript 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-content/plugins/custom-facebook-feed/assets/js/cff-scripts.js?ver=4.1.2
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 324b4935d4141d15c5e8334d0dd4d40161a800060beedffc42ac1cbe0fcec3e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Thu, 24 Feb 2022 07:31:37 GMT
server: nginx
etag: W/"62173459-d58a"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: application/javascript
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 wp-emoji-release.min.js Show response
whospendsmoney.com/wp-includes/js/ 18 KB
5 KB 278ms
276ms Script
application/javascript 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL: https://whospendsmoney.com/wp-includes/js/wp-emoji-release.min.js?ver=02675037ba6757ce19137b9d0b4cb88a
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: br
last-modified: Mon, 09 Aug 2021 06:40:48 GMT
server: nginx
etag: W/"6110cdf0-4705"
vary: Accept-Encoding
x-proxy-cache-info: DT:1
content-type: application/javascript
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 wpm2.jpg
whospendsmoney.com/wp-content/themes/atahualpa/images/header/ 75 KB
76 KB 268ms
261ms Image
image/jpeg 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/themes/atahualpa/images/header/wpm2.jpg
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ba3b3f0ce62cbbb65a58e9dc9ddeeeedbf957399d3d343fd260bdf8f5cd31c7a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Fri, 16 Nov 2012 05:24:56 GMT
server: nginx
etag: "50a5ce28-12cd0"
x-proxy-cache-info: DT:1
content-type: image/jpeg
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 77008
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 expand-down.gif
whospendsmoney.com/wp-content/themes/atahualpa/images/ 57 B
284 B 285ms
280ms Image
image/gif 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/themes/atahualpa/images/expand-down.gif
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f78db0e8b844a2def884e1bd1e9780d2d56646a4aeb81cd5956a8f477ff369ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Fri, 16 Nov 2012 04:17:27 GMT
server: nginx
etag: "50a5be57-39"
x-proxy-cache-info: DT:1
content-type: image/gif
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 57
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 expand-down-white.gif
whospendsmoney.com/wp-content/themes/atahualpa/images/ 57 B
284 B 238ms
225ms Image
image/gif 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/themes/atahualpa/images/expand-down-white.gif
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 25d2442a1ea96e7d980168d54efecf15ce44da2da7cde0246f953f13cd69e156

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Fri, 16 Nov 2012 04:17:27 GMT
server: nginx
etag: "50a5be57-39"
x-proxy-cache-info: DT:1
content-type: image/gif
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 57
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 cff-avatar.png
whospendsmoney.com/wp-content/plugins/custom-facebook-feed/assets/img/ 308 B
537 B 181ms
180ms Image
image/png 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/plugins/custom-facebook-feed/assets/img/cff-avatar.png
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/wp-content/plugins/custom-facebook-feed/assets/css/cff-style.css?ver=4.1.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8eb8ee553ff2601324836019fbdd17b4020f36ff7446209354017116018ea0b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/wp-content/plugins/custom-facebook-feed/assets/css/cff-style.css?ver=4.1.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Thu, 24 Feb 2022 07:31:37 GMT
server: nginx
etag: "62173459-134"
x-proxy-cache-info: DT:1
content-type: image/png
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 308
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET
H2 200 dari2-1024x641.jpg
whospendsmoney.com/wp-content/uploads/2019/10/ 110 KB
111 KB 170ms
168ms Image
image/jpeg 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/uploads/2019/10/dari2-1024x641.jpg
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f10abed3209d31af20103b5f66ccf6df85db7d6df46876b3febae376e1f1181c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Tue, 22 Oct 2019 06:00:45 GMT
server: nginx
etag: "5dae9b0d-1b900"
x-proxy-cache-info: DT:1
content-type: image/jpeg
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 112896
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET Albertsons_RGB.svg
www.albertsons.com/content/dam/safeway/images/logos/ 0
0

GET
H2 404 582c650684ae6caca6ba0e29
www.fredmeyer.com/asset/ 0
0 3796ms
3662ms Image
text/html 104.75.89.43
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.fredmeyer.com/asset/582c650684ae6caca6ba0e29?data=1
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.75.89.43 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-89-43.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H2 200 wsp-coupons.png
whospendsmoney.com/wp-content/uploads/2014/08/ 10 KB
10 KB 170ms
168ms Image
image/png 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://whospendsmoney.com/wp-content/uploads/2014/08/wsp-coupons.png
Requested by: Host: whospendsmoney.com
URL: https://whospendsmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),
Reverse DNS: 31.232.209.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 822366e41a6ffb024b1eeffb85c91ea302ffaf87343a2482fead5572a84da125

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
last-modified: Sun, 17 Aug 2014 21:39:17 GMT
server: nginx
etag: "53f12105-28f3"
x-proxy-cache-info: DT:1
content-type: image/png
cache-control: max-age=31536000
host-header: 8441280b0c35cbc1147f8ba998a563a7
accept-ranges: bytes
content-length: 10483
expires: Tue, 11 Apr 2023 19:25:07 GMT

GET safewayLogo.gif
www.safeway.com/CMS/assets/media/images/ 0
0

GET show_ads.js
pagead2.googlesyndication.com/pagead/ 0
0

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/ 301 KB
108 KB 67ms
67ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2632348965707588&plah=whospendsmoney.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41fa7e8ffbcaa5ce69d951687de0cb45b8e98ea9473635a75615cf49d3b2ff1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110328
x-xss-protection: 0
server: cafe
etag: 1148290837941698068
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 19:25:07 GMT

GET
H3 200 fontawesome-webfont.woff2
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/ 75 KB
76 KB 75ms
39ms Font
font/woff2 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0

Requested by

Host: maxcdn.bootstrapcdn.com
URL: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css?ver=02675037ba6757ce19137b9d0b4cb88a

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css?ver=02675037ba6757ce19137b9d0b4cb88a
Origin: https://whospendsmoney.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
cdn-edgestorageid: 601
access-control-allow-origin: *
cdn-proxyver: 1.02
cdn-cachedat: 04/09/2022 08:19:45
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 77160
timing-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:55 GMT
server: cloudflare
cdn-requestpullcode: 200
etag: "af7ae505a9eed503f8b8e6982036873e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: font/woff2
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 833783c8fe8afdf135affaf7f5fcdf93
accept-ranges: bytes
cf-ray: 6fa61b3acaf66987-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

POST
H2 200 admin-ajax.php Show response
whospendsmoney.com/wp-admin/ 0
400 B 761ms
748ms XHR
text/html 35.209.232.31
GOOGLE-2

General

Check archive.org

Show headers Download Go to

Full URL

https://whospendsmoney.com/wp-admin/admin-ajax.php

Requested by

Host: whospendsmoney.com
URL: https://whospendsmoney.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.209.232.31 Council Bluffs, United States, ASN19527 (GOOGLE-2, US),

Reverse DNS

31.232.209.35.bc.googleusercontent.com

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://whospendsmoney.com/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Mon, 11 Apr 2022 19:25:08 GMT
content-encoding: br
x-content-type-options: nosniff
x-proxy-cache-info: DT:1
host-header: 8441280b0c35cbc1147f8ba998a563a7
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://whospendsmoney.com
x-httpd: 1
cache-control: no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 222 B
649 B 165ms
39ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=whospendsmoney.com&callback=_gfp_s_&client=ca-pub-2632348965707588

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2632348965707588&plah=whospendsmoney.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

387319fd9e108fc5a70ca06b7662fe27171294aa9514c51bc83bdafd00025bb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 167ms
49ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=whospendsmoney.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 168ms
49ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=whospendsmoney.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 11 Apr 2022 19:25:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 47B3 108 KB
14 KB 625ms
522ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2632348965707588&output=html&h=600&slotname=8546813212&adk=1432103522&adf=4164437415&pi=t.ma~as.8546813212&w=120&lmt=1649705107&url=https%3A%2F%2Fwhospendsmoney.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649705107584&bpp=30&bdt=697&idt=235&shv=r20220406&mjsv=m202203300101&ptt=5&saldr=sa&abxe=1&correlator=6394441549083&frm=20&pv=2&ga_vid=1787799220.1649705108&ga_sid=1649705108&ga_hid=2067439772&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=959&ady=1362&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760474%2C31065544&oid=2&pvsid=1804878536849812&pem=810&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cebr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=51gjc7Emlg&p=https%3A//whospendsmoney.com&dtd=281

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4de4ca2c41c2c4598aa0f81e2639169b580db9aeab48279a76da45f50b84ac39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://whospendsmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 13365
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 19:25:08 GMT
expires: Mon, 11 Apr 2022 19:25:08 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 page.php Show response
www.facebook.com/plugins/ Frame F6D2 15 KB
9 KB 89ms
57ms Document
text/html 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2F167132510135830%2F&tabs&width=300&small_header=&adapt_container_width=true&hide_cover=&hide_cta=&show_facepile=&locale=en_US

Requested by

Host: whospendsmoney.com
URL: https://whospendsmoney.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c7ce783b225e387c2bac896779dc74adfe1b967a621b036b4d2c12d91f185c7a

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://whospendsmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html; charset="utf-8"
cross-origin-opener-policy: unsafe-none
date: Mon, 11 Apr 2022 19:25:08 GMT
document-policy: force-load-at-top
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
priority: u=3,i
strict-transport-security: max-age=15552000; preload
vary: Accept-Encoding
x-content-type-options: nosniff
x-fb-debug: UI+A2zifIzHmHRpvd7W9EpHhM2cxBIENVwaydO+61fgg1W/7QhQvPO8iXm1qMmuismKxBow/wafik1POvw8Uiw==
x-fb-rlafr: 0
x-xss-protection: 0

GET
H2 200 vnp_dcHDGoe.css
static.xx.fbcdn.net/rsrc.php/v3/yk/l/0,cross/ Frame F6D2 18 KB
5 KB 162ms
9ms Stylesheet
text/css 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://static.xx.fbcdn.net/rsrc.php/v3/yk/l/0,cross/vnp_dcHDGoe.css?_nc_x=Ij3Wp8lg5Kz

Requested by

Host: www.facebook.com
URL: https://www.facebook.com/plugins/page.php?href=https%3A%2F%2Fwww.facebook.com%2F167132510135830%2F&tabs&width=300&small_header=&adapt_container_width=true&hide_cover=&hide_cta=&show_facepile=&locale=en_US

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

8e163a3d73062a18a707094f865999562f1e354213d616b8458678b65071906f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.facebook.com/
Origin: https://www.facebook.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:08 GMT
content-encoding: br
x-content-type-options: nosniff
content-md5: RKHDisSDm/l6fPad0uoa9Q==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 4777
x-fb-rlafr: 0
x-fb-debug: XZ21dkYa/6vygnd5Hckoj4eC1Dph7DVZbQtWPGoVIJXXKR5c3JTOMxsvLlPm1BGF8JeAjWMOqWgZFA/5sbGsWg==
x-fb-trip-id: 917726464
last-modified: Mon, 01 Jan 2001 08:00:00 GMT
vary: Origin
content-type: text/css; charset=utf-8
access-control-allow-origin: https://www.facebook.com
cache-control: public,max-age=31536000,immutable
timing-allow-origin: *
expires: Tue, 11 Apr 2023 16:48:05 GMT

GET
H2 200 amp-form-0.1.js Show response
cdn.ampproject.org/v0/ Frame 3A2A 51 KB
16 KB 170ms
49ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-form-0.1.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2632348965707588&output=html&h=600&slotname=8546813212&adk=1432103522&adf=4164437415&pi=t.ma~as.8546813212&w=120&lmt=1649705107&url=https%3A%2F%2Fwhospendsmoney.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649705107584&bpp=30&bdt=697&idt=235&shv=r20220406&mjsv=m202203300101&ptt=5&saldr=sa&abxe=1&correlator=6394441549083&frm=20&pv=2&ga_vid=1787799220.1649705108&ga_sid=1649705108&ga_hid=2067439772&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=959&ady=1362&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760474%2C31065544&oid=2&pvsid=1804878536849812&pem=810&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cebr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=51gjc7Emlg&p=https%3A//whospendsmoney.com&dtd=281

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b293fa653e6f6129e63533d815e3a9a1de0bf11a5ae0bffeb155f3e3d40366e

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15374
x-xss-protection: 0
server: sffe
date: Mon, 11 Apr 2022 19:25:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "ed7daae26a884797"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Apr 2022 19:25:08 GMT

GET
H2 200 amp-fit-text-0.1.js Show response
cdn.ampproject.org/v0/ Frame 3A2A 7 KB
3 KB 245ms
124ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-fit-text-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb543e4a0569879162b2cbd1faa40c5ebd27c7cd95cc3beaf98b2b19caf8f8d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2510
x-xss-protection: 0
server: sffe
date: Mon, 11 Apr 2022 19:25:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "e33822ebbe5d7ca2"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Apr 2022 19:25:08 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/ Frame 3A2A 261 KB
68 KB 196ms
76ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/amp4ads-v0.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9452901f434957bf8f24f1ed28cb40ba49bd266d654edf55d83ebf126a6bea4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 69281
x-xss-protection: 0
server: sffe
date: Mon, 11 Apr 2022 19:25:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=3000, stale-while-revalidate=1206600
etag: "e7125de11c10c85b"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Apr 2022 19:25:08 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ Frame 3A2A 110 KB
32 KB 246ms
126ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5e9ef66f3e31e617eab0923cc3b3067f65302790a9e7f85421ee9075a9db9f41

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32365
x-xss-protection: 0
server: sffe
date: Mon, 11 Apr 2022 19:25:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "fc53b7c2d50de298"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Apr 2022 19:25:08 GMT

GET
H2 200 amp-ad-exit-0.1.js Show response
cdn.ampproject.org/v0/ Frame 3A2A 20 KB
7 KB 181ms
62ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-ad-exit-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

989c9ade8964be430445de1e9084c6218fc13a2b3e1259bad0b61d0b63e5cd12

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6818
x-xss-protection: 0
server: sffe
date: Mon, 11 Apr 2022 19:25:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "ab52aa9222d90e26"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Apr 2022 19:25:08 GMT

GET
H2 200 amp-carousel-0.1.js Show response
cdn.ampproject.org/v0/ Frame 3A2A 39 KB
12 KB 262ms
143ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-carousel-0.1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4ea1829c7b6be92081f0b06c7d712ef14c11fc906d4094720c0502904c77451

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11743
x-xss-protection: 0
server: sffe
date: Mon, 11 Apr 2022 19:25:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "f5159c39f2f7c2a1"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Apr 2022 19:25:08 GMT

GET
H3 200 amp-gwd-animation-0.1.js Show response
cdn.ampproject.org/v0/ Frame 3A2A 10 KB
3 KB 168ms
85ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-gwd-animation-0.1.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b47ac3802a2a3329939289c63f8dc679d54ad51e3de175ef0d2641a92e370783

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3538
x-xss-protection: 0
server: sffe
date: Mon, 11 Apr 2022 19:25:08 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "d9aa721843464438"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Mon, 11 Apr 2022 19:25:08 GMT

GET
DATA 200
OK truncated
/ Frame 3A2A 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3f3408809c8c0fc8e41428c6b47c830ff70b28987df1f6dfe7d017596b3799f6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/012203172113000/ 23 KB
8 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012203172113000/amp4ads-host-v0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e96d44180fbc28ad374613f5c43f446cb94c85a80d4edf87d513c5ca2b9b6d7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
age: 528836
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8037
x-xss-protection: 0
server: sffe
date: Tue, 05 Apr 2022 16:31:12 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
etag: "1a8ef148248396b4"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 05 Apr 2023 16:31:12 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3A2A 0
21 B 138ms
91ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CPefYlIBUYvX1Bf2A1fAPr8CDGJb__MJpjpz1tMgPuuHomcsBEAEg9IXrHWCV4pCCoAegAcfw440DyAEJqQIhXsNpQECyPqgDAcgDCKoEyAFP0PzTuozSozAQejxzyJHwFtNJEexflVHPaARP7f3V9HyrAo-Dv4_mS1MyG5BgLMPRTlMA6SKIXfOc30IJTgO7sGeDBv3XHaNmjRMiooo2brg_OK5EibAGDhg7kpK-J1Cq6flQtejeyZCjTVJop4QNHi7cTKY9WJSZqbhp4xz6roNUOYyYokgB9JaVMNQa0mLkJwKMmC34FX7rGb6ekCHh419K9m9TP3pSICnCL71zjJ4QJYltXQ6M6JsBv_iIsmvPUD8PS5rBycAE8eu7-vUDkgUECAQYAZIFBAgFGASgBi6AB6z-onKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBDxqjPSCAkIgOGAEBABGB-ACgHICwHYEwLQFQGAFwGyFxwKGggAEhRwdWItMjYzMjM0ODk2NTcwNzU4OBgA&sigh=xZ29Au1s4DU&uach_m=[]&template_id=419

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2632348965707588&output=html&h=600&slotname=8546813212&adk=1432103522&adf=4164437415&pi=t.ma~as.8546813212&w=120&lmt=1649705107&url=https%3A%2F%2Fwhospendsmoney.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649705107584&bpp=30&bdt=697&idt=235&shv=r20220406&mjsv=m202203300101&ptt=5&saldr=sa&abxe=1&correlator=6394441549083&frm=20&pv=2&ga_vid=1787799220.1649705108&ga_sid=1649705108&ga_hid=2067439772&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=959&ady=1362&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760474%2C31065544&oid=2&pvsid=1804878536849812&pem=810&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cebr%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=51gjc7Emlg&p=https%3A//whospendsmoney.com&dtd=281
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 11 Apr 2022 19:25:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 11 Apr 2022 19:25:09 GMT

GET
H2 200 en.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 3A2A 2 KB
3 KB 350ms
38ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/en.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 18:59:48 GMT
x-content-type-options: nosniff
server: cafe
age: 1521
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 14819457070020093239
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2502
x-xss-protection: 0
expires: Tue, 12 Apr 2022 18:59:48 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/adchoices/ Frame 3A2A 295 B
757 B 348ms
37ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/adchoices/icon.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 05:43:34 GMT
x-content-type-options: nosniff
server: cafe
age: 49295
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag: 426692510519060060
vary: Accept-Encoding
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Tue, 12 Apr 2022 05:43:34 GMT

GET
H2 200 img1.jpg
tpc.googlesyndication.com/sadbundle/8827039610140187032/ Frame 3A2A 30 KB
30 KB 315ms
91ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/8827039610140187032/img1.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

963c6ca0e36fa61895c8b8de8bb9d8c7a6d8eca303e847288945fabb1a7894f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 10 Apr 2022 22:12:28 GMT
x-content-type-options: nosniff
age: 76361
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30427
x-xss-protection: 0
last-modified: Wed, 06 Apr 2022 16:48:55 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 10 Apr 2023 22:12:28 GMT

GET
H2 200 img2.jpg
tpc.googlesyndication.com/sadbundle/8827039610140187032/ Frame 3A2A 28 KB
28 KB 270ms
47ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/8827039610140187032/img2.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

033841997719c1ab49b3afc41a5835dde4e844dbbbca9078739c32682a4e375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 10 Apr 2022 22:12:28 GMT
x-content-type-options: nosniff
age: 76361
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28880
x-xss-protection: 0
last-modified: Wed, 06 Apr 2022 16:48:55 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 10 Apr 2023 22:12:28 GMT

GET
H2 200 img3.jpg
tpc.googlesyndication.com/sadbundle/8827039610140187032/ Frame 3A2A 43 KB
43 KB 337ms
114ms Image
image/jpeg 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/8827039610140187032/img3.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6215723dafe077dd4bfafee04ff5f4347b8cd747be7e402a5de71c6c8ec5e63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 10 Apr 2022 22:12:28 GMT
x-content-type-options: nosniff
age: 76361
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43764
x-xss-protection: 0
last-modified: Wed, 06 Apr 2022 16:48:55 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 10 Apr 2023 22:12:28 GMT

GET
H2 200 logo.png
tpc.googlesyndication.com/sadbundle/8827039610140187032/ Frame 3A2A 5 KB
5 KB 266ms
43ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/8827039610140187032/logo.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d423197f1c550a04dca864011f9cce942ba657ce4f046bd30edf4230073466b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 10 Apr 2022 22:12:28 GMT
x-content-type-options: nosniff
age: 76361
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4817
x-xss-protection: 0
last-modified: Wed, 06 Apr 2022 16:48:55 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 10 Apr 2023 22:12:28 GMT

GET
H2 200 cta_img1.png
tpc.googlesyndication.com/sadbundle/8827039610140187032/ Frame 3A2A 1 KB
1 KB 263ms
43ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/8827039610140187032/cta_img1.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11bf6617df4be4f533236db23a1838a7aca42b4e1f019b5255caace0d6581bc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 10 Apr 2022 22:12:28 GMT
x-content-type-options: nosniff
age: 76361
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1413
x-xss-protection: 0
last-modified: Wed, 06 Apr 2022 16:48:55 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 10 Apr 2023 22:12:28 GMT

GET
H2 200 logo_garantie.png
tpc.googlesyndication.com/sadbundle/8827039610140187032/ Frame 3A2A 3 KB
4 KB 261ms
42ms Image
image/png 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/8827039610140187032/logo_garantie.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a3934146800d568b36182d4230b1c80531167214f484143a0255787c3284987d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 10 Apr 2022 22:12:28 GMT
x-content-type-options: nosniff
age: 76361
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3297
x-xss-protection: 0
last-modified: Wed, 06 Apr 2022 16:48:55 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 10 Apr 2023 22:12:28 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 154 KB
53 KB 64ms
63ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db9ded3f06c4e0f3d3def58e9ef56deb19217eb4ab14f306080738c5665f5f82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53941
x-xss-protection: 0
server: cafe
etag: 15325737197114208013
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Mon, 11 Apr 2022 19:25:09 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 103ms
55ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220406&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e5b81ed2bb2ba084a734db7ef43a70d8a912c1ee670690dfe68f559ba6230ff6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 11 Apr 2022 19:25:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10484
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220406/r20190131/ Frame 4067 10 KB
4 KB 71ms
39ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220406/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://whospendsmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 6117
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4398
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 17:43:12 GMT
etag: 14837630671339829333
expires: Mon, 25 Apr 2022 17:43:12 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 102ms
54ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=whospendsmoney.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 11 Apr 2022 19:25:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 101ms
52ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=whospendsmoney.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 11 Apr 2022 19:25:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A10A 0
16 B 75ms
63ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2632348965707588&output=html&adk=1812271804&adf=3025194257&lmt=1649705109&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwhospendsmoney.com%2F&ea=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649705109580&bpp=2&bdt=2693&idt=2&shv=r20220406&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Dba075840cc54086e-22fcbffc74cd00bf%3AT%3D1649705107%3ART%3D1649705107%3AS%3DALNI_MZocIkSLrLJl_RgiozVizmBG-vokg&prev_slotnames=8546813212&nras=1&correlator=6394441549083&frm=20&pv=1&ga_vid=1787799220.1649705108&ga_sid=1649705108&ga_hid=2067439772&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760474%2C31065544&oid=2&pvsid=1804878536849812&pem=810&tmod=1852542626&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=2&uci=a!2&fsb=1&dtd=34

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://whospendsmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 19:25:09 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 108ms
57ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 11 Apr 2022 19:25:09 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 1A35 13 KB
5 KB 43ms
42ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://whospendsmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 187
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 19:22:02 GMT
expires: Tue, 11 Apr 2023 19:22:02 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 6166 783 B
1 KB 565ms
50ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

bfd9a4cd0806d00cd53539e0d733bae64b413b61f24581386a9807bf596acd35

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-DK1A+/eADveRz1LenaNUUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://whospendsmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-DK1A+/eADveRz1LenaNUUg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 19:25:10 GMT
expires: Mon, 11 Apr 2022 19:25:10 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 yPRSpnmC7kCVHbP5HJYGhFaCAnVrOjYDhSjhq7GpE_U.js Show response
pagead2.googlesyndication.com/bg/ Frame 1A35 35 KB
13 KB 41ms
41ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/yPRSpnmC7kCVHbP5HJYGhFaCAnVrOjYDhSjhq7GpE_U.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c8f452a67982ee40951db3f91c960684568202756b3a36038528e1abb1a913f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 06:53:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 45101
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13627
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Apr 2023 06:53:29 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 6166 0
0 110ms
109ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220406&jk=1804878536849812&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 1A35 0
9 B 39ms
39ms Image
text/plain 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?KYwsOw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:25:10 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 75ms
74ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220406&jk=1804878536849812&bg=!e3ileDzNAAZAkm7qYJI7ACkAdvg8WvK5NhJdR56ZhPa5sURs8lHn51JlMZJk3nGaMlllu4YOIQ1e7wIAAABfUgAAAAJoAQeZAqlwqSACKs4CnC8_N8z7q_JSCv8L3mEPsdRogRVQ-9sPLMuPiXGkkNxHMXRKNSu8YMkNtShJYMTBSQzP_uPbkCiQURnYBDpvjrJTQ3-bdszgykHBu3SnHIEa5OjH4Fzt1qMFwqO6-xPpz2NcSe84CVJ_ju8k8c-0TA0AJa6MHdEs4D7dqIwaAotElbP1TZUOv0ZrcSyyy4hFr1vTjkW3z5y61YtL1sFh8j9vkWbVAOuF5jeGhsNIXClyMKl6bjZ_ef9j9FLKxPZAAPiCl4lYIeTdBz4kTcrIKNdVYPu78guI9VTct6eS9UL6_9hAhuL3xGxF-B9lxzTu_zSauJ_nyXSew6PKhiIkky6nc4YL-SnxWqsazn-Kvl2N3A9wjinr-MSYQdWDEDLE9Gr0C0IiJmpTt8pWmS15dZDfo63wyCzGRyjMtDdeBLv9F5jnuTWwK08XxrKWRFW-Y7WimjOlKqinB_fkLnR4uPFdbpXU8PBCX--aSX0f04e1iQBba6w9oVc8nbVJPYmYpKdi0lIHIWtFrgObZ3sVfZF8OU4MvE6ya3YW0A8_P3U7t20lrJ5Yi0lNdrWdMabrfRxobA2DLV19Cd0Q0YbzwgcVJFK0bSDIjF6zFI5gMZpTeduioKDCMC5dt4TKu2NkI77aam_Xk2dwL7HXrOacslPxhCwstl4vp5HwheAZgpPXpO8VmVYHxjeZqXLnFgTVKC2LGwT7QngcJJprggGlPKhr7XYhG1JzktPCqYehls02urqCac0CHndQMkbkEJbFMxhP9rbzbJlKV6ilaPLD9Vn-JD-BHvPypNS7mlsytenUvLYGdYVb2ZPGDumWbEggaw8WXqEczTCZvIh-VspG8pTPW_i3qSg_B5ERlwTDiK2luOdfb8V04lpiWIE9iv5Jfzs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://whospendsmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 11 Apr 2022 19:25:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.albertsons.com
URL: https://www.albertsons.com/content/dam/safeway/images/logos/Albertsons_RGB.svg

Domain: www.safeway.com
URL: https://www.safeway.com/CMS/assets/media/images/safewayLogo.gif

Domain: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/show_ads.js

Verdicts & Comments Add Verdict or Comment

198 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.whospendsmoney.com/	1970-01-20 11:36:41	Name: __gads Value: ID=ba075840cc54086e-22fcbffc74cd00bf:T=1649705107:RT=1649705107:S=ALNI_MZocIkSLrLJl_RgiozVizmBG-vokg
			.doubleclick.net/	1970-01-20 11:36:41	Name: IDE Value: AHWqTUk5gt8k4g-B6T_lGflAHNB5EMqxuIY7zrH9KJd5KKn6mOAzNKoyRZVG9aQNZx4

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	URL: https://whospendsmoney.com/(Line 448) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 448) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 546) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over a secure connection, but contains a form that targets an insecure endpoint 'http://whospendsmoney.com/mlist/?p=subscribe&id=1'. This endpoint should be made available over a secure connection.
security	warning	URL: https://whospendsmoney.com/(Line 549) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 549) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 549) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 549) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 644) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 644) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 644) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	warning	URL: https://whospendsmoney.com/(Line 644) Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure element 'http://www.safeway.com/CMS/assets/media/images/safewayLogo.gif'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security	error	URL: https://whospendsmoney.com/ Message: Mixed Content: The page at 'https://whospendsmoney.com/' was loaded over HTTPS, but requested an insecure script 'http://pagead2.googlesyndication.com/pagead/show_ads.js'. This request has been blocked; the content must be served over HTTPS.
other	warning	URL: https://cdn.ampproject.org/v0/amp-ad-exit-0.1.js(Line 1) Message: Unrecognized feature: 'attribution-reporting'.
network	error	URL: https://www.fredmeyer.com/asset/582c650684ae6caca6ba0e29?data=1 Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

adservice.google.com
adservice.google.de
cdn.ampproject.org
googleads.g.doubleclick.net
maxcdn.bootstrapcdn.com
pagead2.googlesyndication.com
partner.googleadservices.com
scontent-ort2-1.xx.fbcdn.net
static.xx.fbcdn.net
tpc.googlesyndication.com
whospendsmoney.com
www.albertsons.com
www.facebook.com
www.fredmeyer.com
www.google.com
www.safeway.com
pagead2.googlesyndication.com
www.albertsons.com
www.safeway.com
104.75.89.43
142.250.185.66
2606:4700::6812:bcf
2a00:1450:4001:80e::2002
2a00:1450:4001:810::2004
2a00:1450:4001:811::2002
2a00:1450:4001:812::2001
2a00:1450:4001:812::2002
2a00:1450:4001:813::2001
2a03:2880:f027:18:face:b00c:0:3
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
35.209.232.31
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
033841997719c1ab49b3afc41a5835dde4e844dbbbca9078739c32682a4e375f
11bf6617df4be4f533236db23a1838a7aca42b4e1f019b5255caace0d6581bc8
1efd2d1ec9705fca24e54f5c961bc092eb6fb995cbe3912a44cdef4613b217a7
25d2442a1ea96e7d980168d54efecf15ce44da2da7cde0246f953f13cd69e156
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
324b4935d4141d15c5e8334d0dd4d40161a800060beedffc42ac1cbe0fcec3e5
340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295
36133ca07927c88a7cc578fddbaed3c668ab75087834d0ca13dca5de4ec856c1
387319fd9e108fc5a70ca06b7662fe27171294aa9514c51bc83bdafd00025bb0
388ab7222ffb7a76088a7a12dd3529aeb4f3a3b0f2c207eeda623a0f0d5d9192
3aabb33f726a685a62ff6d203087192d97c986c3190ac642d26fbf5465ef27bf
3e96d44180fbc28ad374613f5c43f446cb94c85a80d4edf87d513c5ca2b9b6d7
3f3408809c8c0fc8e41428c6b47c830ff70b28987df1f6dfe7d017596b3799f6
41fa7e8ffbcaa5ce69d951687de0cb45b8e98ea9473635a75615cf49d3b2ff1c
43d57fbb7bff94a1c232195530c60c873e51f8d214628e4711509cae84ac21a8
47be67fc4ce329ea0d01e275139dc53c376b3a55cd09cbf45f89d39890a847bd
4de4ca2c41c2c4598aa0f81e2639169b580db9aeab48279a76da45f50b84ac39
4f7f54ecb04d7f9918c84c70d741fd31219f04c2b73553109e155a3b9b23719e
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
59b00ee3ac3a3aaa1d45426d750e7142dde36965ac18a61c83ac2433f62550ec
5e9ef66f3e31e617eab0923cc3b3067f65302790a9e7f85421ee9075a9db9f41
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
679e44f9b4bbbc2ad0c4000c1413fd3a88627d83f1cba8ebdac26f81bc7edb78
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7fd59024b6ca83f11f7a3448ec148309a13b705725716df134f699e60a96eb1b
822366e41a6ffb024b1eeffb85c91ea302ffaf87343a2482fead5572a84da125
8e163a3d73062a18a707094f865999562f1e354213d616b8458678b65071906f
8eb8ee553ff2601324836019fbdd17b4020f36ff7446209354017116018ea0b9
963c6ca0e36fa61895c8b8de8bb9d8c7a6d8eca303e847288945fabb1a7894f1
989c9ade8964be430445de1e9084c6218fc13a2b3e1259bad0b61d0b63e5cd12
9b293fa653e6f6129e63533d815e3a9a1de0bf11a5ae0bffeb155f3e3d40366e
a3934146800d568b36182d4230b1c80531167214f484143a0255787c3284987d
a3e64300797e8078baa41dbc49e2affc1d2bedd04a470f0c929ed7fac698fbcd
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a9452901f434957bf8f24f1ed28cb40ba49bd266d654edf55d83ebf126a6bea4
b47ac3802a2a3329939289c63f8dc679d54ad51e3de175ef0d2641a92e370783
b4ea1829c7b6be92081f0b06c7d712ef14c11fc906d4094720c0502904c77451
ba3b3f0ce62cbbb65a58e9dc9ddeeeedbf957399d3d343fd260bdf8f5cd31c7a
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bd4f5bcac3650d2778bd48496d62be3d6fbd0922701405afa0df28bd19c5c3fd
bfd9a4cd0806d00cd53539e0d733bae64b413b61f24581386a9807bf596acd35
c6215723dafe077dd4bfafee04ff5f4347b8cd747be7e402a5de71c6c8ec5e63
c7ce783b225e387c2bac896779dc74adfe1b967a621b036b4d2c12d91f185c7a
c8f452a67982ee40951db3f91c960684568202756b3a36038528e1abb1a913f5
cc7d61a19e29d0eab07de4437d2fa2b0af07050a408d0db174c166a3c220a4b6
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
d423197f1c550a04dca864011f9cce942ba657ce4f046bd30edf4230073466b4
db9ded3f06c4e0f3d3def58e9ef56deb19217eb4ab14f306080738c5665f5f82
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e20ddb9ed1fa044cb624f0253bb06b13c92ed9915063bd63a5806440c6b1ce7c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e50f9ccd2d6582a58ba1879fa578e60d25fea4c5eedc07deafd14482b2403181
e5b81ed2bb2ba084a734db7ef43a70d8a912c1ee670690dfe68f559ba6230ff6
efb543e4a0569879162b2cbd1faa40c5ebd27c7cd95cc3beaf98b2b19caf8f8d
f10abed3209d31af20103b5f66ccf6df85db7d6df46876b3febae376e1f1181c
f6d3ae7ad953291efcbfd5cb7b88a931d55231037419b1c406682c7a8e8d1e93
f78db0e8b844a2def884e1bd1e9780d2d56646a4aeb81cd5956a8f477ff369ee

whospendsmoney.com Open in urlscan Pro 35.209.232.31 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

69 Requests

96 %HTTPS

77 %IPv6

13 Domains

16 Subdomains

14 IPs

2 Countries

941 kBTransfer

2207 kBSize

2 Cookies

23 Outgoing links

Redirected requests

69 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

whospendsmoney.com Open in urlscan Pro
35.209.232.31 Public Scan

Screenshot
Live screenshot

Full Image

69
Requests

96 %
HTTPS

77 %
IPv6

13
Domains

16
Subdomains

14
IPs

2
Countries

941 kB
Transfer

2207 kB
Size

2
Cookies

69 HTTP transactions
1 data transactions