blogtuan.info Open in urlscan Pro
45.252.249.31 Public Scan

Software

cafe /

Resource Hash

b6a8da03ed5315a42805b7c778098fa801da7df5d911e1275182ae14e950169f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 194
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 135ms
49ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=blogtuan.info

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 133ms
48ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=blogtuan.info

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame CF57 269 KB
57 KB 610ms
561ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&adk=2969136045&adf=3689892565&lmt=1638185176&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fblogtuan.info%2F&ea=0&flash=0&host=ca-host-pub-2644536267352236&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185175971&bpp=16&bdt=621&idt=208&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=2909481184534&frm=20&pv=2&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=221

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7b8b60e5dc74f0860af016ad4f1f837a3669154e35017581efda221b4b302b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 29 Nov 2021 11:26:16 GMT
server: cafe
content-length: 58228
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:16 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 260F 120 KB
39 KB 944ms
904ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&slotname=9795689928&adk=165382125&adf=2004953962&pi=t.ma~as.9795689928&w=770&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&psa=0&format=770x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176013&bpp=3&bdt=663&idt=183&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=615&ady=20&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=xWV7T5aaD2&p=https%3A//blogtuan.info&dtd=188

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6789028296020f1b12f15fa840945adf48f30ba9672c40e606830ad813ba84ad

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CL71iKy7vfQCFeZDHQkd4uAArg&gqi=2LikYeOUEOKEwuIP26qvsAg&layout=/sadbundle/%24csp%253Der3%24/14795368434310693961/index.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CL71iKy7vfQCFeZDHQkd4uAArg&gqi=2LikYeOUEOKEwuIP26qvsAg&layout=/sadbundle/%24csp%253Der3%24/14795368434310693961/index.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 39764
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

GET
H2 200 blogtuaninfo.json Show response
json.foxpush.com/ 997 B
1 KB 49ms
22ms XHR
application/json 2606:4700:3034::ac43:8697
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://json.foxpush.com/blogtuaninfo.json?v=0.0062999244357928585
Requested by: Host: cdn.foxpush.net
URL: https://cdn.foxpush.net/sdk/foxpush_SDK_min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::ac43:8697 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 51e1ed7239af71ff0fe68ff77b8d0c3ac61c53f08fbcdfb14ea9518b5b2646c2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: br
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Mon, 29 Nov 2021 05:28:53 GMT
server: cloudflare
etag: W/"3e5-17d6a2adb0b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gXPAa7SVr6y4qFiyuROe%2F4bjuWWmTPVBt8td3oMmGxsCw9seaUZUjHI41s1qT1y%2BtdYwEQgXvHKPoLeWXKqbn%2Ba7Iw6k%2BCcoY8A48fZHOYd2UqInojxzboG8B2HkbDlXrmUufUZZarzHr%2F05jT9M"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1800
cf-ray: 6b5b7ae7886a2c52-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 index.html Show response
www.foxpush.com/source/ Frame A254 1 KB
1 KB 230ms
183ms Document
text/html 2606:4700:3034::6815:648
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.foxpush.com/source/index.html?fox_domain=blogtuaninfo.foxpush.net&hurl=https%3A%2F%2Fblogtuan.info%2F
Requested by: Host: cdn.foxpush.net
URL: https://cdn.foxpush.net/sdk/foxpush_SDK_min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3034::6815:648 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e62ca1eaa5187d6f70762cc4871ff7412cb4b5c8d63aa8dff42329f4dba15657

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
content-type: text/html
last-modified: Wed, 28 Jul 2021 19:37:19 GMT
x-amz-version-id: 7U79eS3jd6XVrFzX627aKt8THwzOWR.n
x-cache: Hit from cloudfront
via: 1.1 cb33a7a4640adbb55df3e0d143601559.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C1
x-amz-cf-id: mMNv4opEiuoq-3yW0JzgqlEH0yvvZMQNq68MsrERoHTiSAtoRv17xw==
age: 55775
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ybISzeO0pW1Dgw4fDJ%2Bm1%2BzfM%2BDZ%2FAMer0Dux02GRRI2A7kBFn264Q78Pu3KoDh9FpFbgNiqPtVDVccXBiDQJzwhrHLH6c%2FScCPTq7Cr6m%2BkT2%2FjL5ps62aeYHQMNYP9zlyjT1Tnou4ECnoXtbE%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6b5b7ae7fbbb68e9-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

OPTIONS
H2 200 /
foxpush-leads.com/lead_request/ Frame 0
0 47ms
19ms Preflight
text/html 2606:4700:3030::ac43:9fb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://foxpush-leads.com/lead_request/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3030::ac43:9fb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://blogtuan.info
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
content-type: text/html; charset=utf-8
access-control-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
allow: POST
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a4AUE8t3K2kFp6XpbbPdgN16QQ5AvlWKzcHhhkE%2FQVDO%2FmdSA0z%2Bvi7CKKXIG8h37HjKDkfpVwtFvAG7NjBihuBSdwvGzhZp5fuw3S7KDg5ZerCw%2BDjbo7bXdvZX1vKxLZAz%2Ftcuygv52Q0PdUUw5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6b5b7ae7e948c2c2-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

POST
H3 200 / Show response
foxpush-leads.com/lead_request/ 44 B
707 B 54ms
43ms XHR
application/json 2606:4700:3030::ac43:9fb0
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://foxpush-leads.com/lead_request/
Requested by: Host: cdn.foxpush.net
URL: https://cdn.foxpush.net/sdk/foxpush_SDK_min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:9fb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 25e1b83549f2cd5ebb2f71b57d150aad9561668fc0aeaea3354b6074b7a9f228

Request headers

Referer: https://blogtuan.info/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-type: application/json;charset=UTF-8

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
etag: W/"2c-KfJyabuKrfo+vU/7x2O+jFljDDk"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AhAMbjY%2FlXd%2BfcMFXaDHOlNjK%2FPzH5kACgxSxfCJT%2FMqqAph3Sc%2BBq3iZlih%2FSE9pL2Eb0iYJXF9YyjOLdzlk8DBgAPrXs%2Bt1h8n7Wy3rB1B%2Frqxb%2BhXjSHiVvBYjEfkb2bSeIxzfPXvN6bMUQDd8A%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cf-ray: 6b5b7ae8194a3248-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 44

GET
H3 200 foxpush_SDK_min.css
cdn.foxpush.net/sdk/ 21 KB
6 KB 42ms
25ms Stylesheet
text/css 2606:4700:3030::6815:32f6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.foxpush.net/sdk/foxpush_SDK_min.css?v=1544652719
Requested by: Host: cdn.foxpush.net
URL: https://cdn.foxpush.net/sdk/foxpush_SDK_min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::6815:32f6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8e7a602e420b13bf0ec8bc909755748532f62765968b211fc33c1b15f5b12a8e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: br
cf-cache-status: EXPIRED
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Tue, 06 Jul 2021 20:47:38 GMT
server: cloudflare
etag: W/"5581-17a7d938997"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W10AY0pUd9v6dDvRPAR9x2Wge%2B4mBTxbTzBhFJNhw0xpF1tvH1xZyM5fjv4a5d80P1QJuSg7wmSg1yV6ZqETg%2FssuBTIE1Wwb8mltiKx9Dh%2Fm9AeDYhWVzRnh52ffbe2xEbAVyRFbRFubjGRD2g%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cf-ray: 6b5b7ae7ca37698b-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 css
fonts.googleapis.com/ 1 KB
685 B 46ms
45ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins&subset=latin&display=swap

Requested by

Host: ajax.googleapis.com
URL: https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f94fc133e3ddaef1a9c299f5d7b4f608753ef156544ba9d591284ddff0e40fd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 11:26:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 29 Nov 2021 11:26:16 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 29 Nov 2021 11:26:16 GMT

POST
H3 204 collect
www.google-analytics.com/g/ 0
17 B 96ms
47ms Ping
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-3PS82M7474&gtm=2oeba1&_p=652958358&sr=1600x1200&gdid=dZTNiMT&ul=en-us&cid=1159209771.1638185176&_s=1&dl=https%3A%2F%2Fblogtuan.info%2F&dt=latest%20news%20today%20blogtuan.info%20%E2%80%93%20Latest%20news%20today%20blogtuan.info%2C%2024%20hour%20news%20accurate%20and%20reliable%2C%20Latest%20news%20in%20Vietnam%20and%20the%20world%20about%20health%2C%20sports%2C%20tourism%2C%20culture%2C%20society&sid=1638185176&sct=1&seg=0&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-3PS82M7474&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://blogtuan.info/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blogtuan.info
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pxiEyp8kv8JHgFVrJJfecg.woff2
fonts.gstatic.com/s/poppins/v15/ 8 KB
8 KB 127ms
40ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Poppins&subset=latin&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blogtuan.info
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 22 Nov 2021 21:14:29 GMT
x-content-type-options: nosniff
age: 569507
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7900
x-xss-protection: 0
last-modified: Thu, 05 Nov 2020 22:02:01 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Tue, 22 Nov 2022 21:14:29 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 53ms
46ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&aip=1&a=652958358&t=pageview&_s=1&dl=https%3A%2F%2Fblogtuan.info%2F&ul=en-us&de=UTF-8&dt=latest%20news%20today%20blogtuan.info%20%E2%80%93%20Latest%20news%20today%20blogtuan.info%2C%2024%20hour%20news%20accurate%20and%20reliable%2C%20Latest%20news%20in%20Vietnam%20and%20the%20world%20about%20health%2C%20sports%2C%20tourism%2C%20culture%2C%20society&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YCDACUABBAAAAC~&jid=370292307&gjid=2013850683&cid=1159209771.1638185176&tid=UA-212457016-1&_gid=2079502457.1638185176&_r=1&gtm=2ouba1&did=dZTNiMT&gdid=dZTNiMT&z=1522428083

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://blogtuan.info/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:16 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://blogtuan.info
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ Frame A254 77 KB
27 KB 142ms
58ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.foxpush.com
URL: https://www.foxpush.com/source/index.html?fox_domain=blogtuaninfo.foxpush.net&hurl=https%3A%2F%2Fblogtuan.info%2F

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3ab98a11303695462aaa63309ffa207915c6ec8c6f514c6193cfa57c6796d8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1058 / 738 of 1000 / last-modified: 1637708722"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26861
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 29 Nov 2021 11:26:16 GMT

GET
H2 200 learn
mena-gmtdmp.mookie1.com/t/v2/ Frame A254 43 B
324 B 108ms
20ms Image
image/gif 35.186.238.175
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mena-gmtdmp.mookie1.com/t/v2/learn?tagid=V2_961593&src.rand=0.13904693772720345
Requested by: Host: www.foxpush.com
URL: https://www.foxpush.com/source/index.html?fox_domain=blogtuaninfo.foxpush.net&hurl=https%3A%2F%2Fblogtuan.info%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.238.175 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 175.238.186.35.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:16 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 pubads_impl_2021111601.js Show response
securepubads.g.doubleclick.net/gpt/ Frame A254 344 KB
116 KB 93ms
48ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eee78aaf4f9dc8d0d36d3dddbaad9094ace5d91611f9aee6fe0b44b0ed46ccc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 118471
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 09:34:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Mon, 29 Nov 2021 11:26:16 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/ 147 KB
52 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/reactive_library_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

876fe6592ed729e7eda6c048fd3014e71f0ac7761528df3b3dcbde113b5f1c5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53391
x-xss-protection: 0
server: cafe
etag: 9744683334204761242
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Mon, 29 Nov 2021 11:26:16 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 95ms
48ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=blogtuan.info

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 91ms
46ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=blogtuan.info

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 77DE 83 KB
31 KB 494ms
494ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3049379357&adf=1527168045&pi=t.aa~a.2856682273~rp.3&w=390&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=390x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280&nras=2&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=964&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2qEYZ2tmCW&p=https%3A//blogtuan.info&dtd=15

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31abae43b0ac2649f39d27e7cea19cbcd776d17c764ca2887b13c4fa8520a0fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 31586
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 66B4 28 KB
12 KB 839ms
839ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3149249042&adf=2279666065&pi=t.aa~a.2964750914~rp.2&w=379&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=379x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280&nras=3&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=2790&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tpYqTUWWo1&p=https%3A//blogtuan.info&dtd=68

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8b44916332c868c4fb3ee89557a9ff7e563abf94b4f2f6a718c8dd13714f77cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 12069
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8914 18 KB
9 KB 712ms
711ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=472186380&pi=t.aa~a.508084115~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=2&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280&nras=4&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=3114&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Pun8NNpk3m&p=https%3A//blogtuan.info&dtd=71

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

830e33e3b4ad08d4a56b307f0c98d17c50a2490ce3e6f4460e04cf5a9c4a80f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 9635
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5068 73 KB
29 KB 683ms
682ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=2449947586&adf=2847098451&pi=t.aa~a.2964927557~rp.2&w=383&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=383x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1541&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280&nras=5&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=3699&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wSxp47vDvn&p=https%3A//blogtuan.info&dtd=74

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

97894e7f82b18320e505a713f3a43c4e7f9d9d5fba628afa21eec8d47dd9e80a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 30091
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EBA5 83 KB
34 KB 930ms
930ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

74dae253ffcd8755eacea8fcd88d713c6b30bb7c80479aad5f56cbcd2e689733

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 35107
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E5C0 89 KB
32 KB 1177ms
1177ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3766246314&adf=4214349505&pi=t.aa~a.2964928988~rp.2&w=395&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=395x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280%2C417x280&nras=7&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=4347&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=lLgdFIHTY6&p=https%3A//blogtuan.info&dtd=80

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a208632de098c38f56dfcd357d277dc53dd4286877ea5861ca7958f5d279ea2d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Mon, 29 Nov 2021 11:26:18 GMT
server: cafe
content-length: 33194
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: private

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ Frame A254 107 B
122 B 49ms
49ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.foxpush.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame A254 107 B
122 B 46ms
46ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.foxpush.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame A254 17 KB
10 KB 267ms
267ms XHR
text/plain 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2383162639821943&correlator=2202235055783384&output=ldjh&impl=fifs&eid=31063811%2C31063812%2C31062931&vrg=2021111601&ptt=17&sc=1&sfv=1-0-38&ecs=20211129&iu_parts=21795300705%2CDSP_interstitial&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x480&cdm=www.foxpush.com&bc=31&abxe=1&lmt=1627501039&dt=1638185177006&dlt=1638185176502&idt=489&ea=0&frm=24&biw=-12245933&bih=-12245933&oid=2&adxs=-12245933&adys=-12245933&adks=665474176&ucis=sj3hncn5byaz&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&nhd=1&url=https%3A%2F%2Fwww.foxpush.com%2Fsource%2Findex.html%3Ffox_domain%3Dblogtuaninfo.foxpush.net%26hurl%3Dhttps%253A%252F%252Fblogtuan.info%252F&ref=https%3A%2F%2Fblogtuan.info%2F&top=https%3A%2F%2Fblogtuan.info%2F&vis=1&dmc=8&scr_x=-12245933&scr_y=-12245933&psz=0x0&msz=0x0&ga_vid=506180408.1638185177&ga_sid=1638185177&ga_hid=1649832838&ga_fc=false&fws=256&ohw=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1cda176dbacb63c0e6e364f6d4ae16e65487964c6fc162c4a0fb2d24ccb95043

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9771
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.foxpush.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A94D 6 KB
4 KB 167ms
47ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 29 Nov 2021 11:26:17 GMT
expires: Tue, 29 Nov 2022 11:26:17 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/ Frame 1126 11 KB
5 KB 40ms
39ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 17:15:06 GMT
expires: Sun, 12 Dec 2021 17:15:06 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 65471
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/ Frame 6042 11 KB
5 KB 39ms
39ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blogtuan.info/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 17:15:06 GMT
expires: Sun, 12 Dec 2021 17:15:06 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 65471
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css2
fonts.googleapis.com/ Frame 1126 4 KB
634 B 96ms
48ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 09:48:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 29 Nov 2021 11:26:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 1126 205 B
519 B 138ms
46ms Image
image/png 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 01:28:22 GMT
x-content-type-options: nosniff
age: 35875
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 29 Nov 2022 01:28:22 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 1126 604 B
766 B 138ms
46ms Image
image/png 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 09:42:03 GMT
x-content-type-options: nosniff
age: 6254
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 29 Nov 2022 09:42:03 GMT

GET
H2 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 1126 18 KB
8 KB 158ms
66ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db8deb30d5cecf873a6361b5410aed53a439e46072dcd6af4dc2481e44ea2a59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:18:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 474
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8141
x-xss-protection: 0
server: cafe
etag: 15959965552278146708
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:18:23 GMT

GET
H2 200 548bdb63b969e5c27f75e62faf543d70.js Show response
www.gstatic.com/mysidia/ Frame 6042 7 KB
4 KB 127ms
39ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/548bdb63b969e5c27f75e62faf543d70.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

541a22e85f3238899f2589d44b9390a8d6d6e193a5d436c10e8ec9ce7b256e76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:03:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 483796
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3286
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 21 Feb 2022 21:03:01 GMT

GET
H2 200 1fbe479ac890063fc5be4921f3467642.js Show response
www.gstatic.com/mysidia/ Frame 6042 8 KB
4 KB 129ms
42ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/1fbe479ac890063fc5be4921f3467642.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9bbd26c49f5ae124707da73ee22462fbc47ca1d38e85825771170e4b1c850af7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 21:03:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 483795
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3713
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 21 Feb 2022 21:03:02 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 6042 3 KB
579 B 90ms
49ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 09:47:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 29 Nov 2021 11:26:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 6042 1 KB
960 B 163ms
76ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:22:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 238
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:22:19 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 6042 19 KB
8 KB 123ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:25:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:25:41 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 6042 2 KB
1 KB 163ms
77ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:24:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:24:34 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 6042 119 KB
37 KB 138ms
53ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 6042 15 KB
6 KB 127ms
42ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H2 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame 6042 27 KB
11 KB 132ms
47ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 12:44:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254517
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 24 Feb 2022 12:44:20 GMT

GET
H2 200 index.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/ Frame 272F 209 KB
85 KB 76ms
75ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/index.html

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cffe96c5084ebed16794afba896928249d814d7886887dc98ea3150868c87c3d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin: *
date: Sun, 28 Nov 2021 23:13:57 GMT
expires: Mon, 28 Nov 2022 23:13:57 GMT
last-modified: Wed, 27 Oct 2021 11:08:22 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 85644
age: 43940
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E7F5 0
0 81ms
81ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CxJzs2LikYb6pEeaH9fgP4sGD8Aryk5GrZcrmj42CD9rZHhABILKy4YsBYJXikIKgB6AB2IWg6APIAQmpAj1RnsSV_bI-qAMByANIqgTnAU_QzSnKTUYjs0lVmqZmvGeIhtSx8XRgrCOHc-T9S8AGTxVpvjEKl84YZX2M3gvY3L2NTVn2he92GVcOEbBRI_uZLfLK05ykrcvzKpz3wFTtXXaQyvrFCMChrNJTJw5lvG_gzVVVzFiikZbWHUKls3yQCv5Po6m1ANtV4X_4rX_mNW5loKOzSJSGuzPHtD1bNsqc5fYE-jSLy7YBftF1HMHSNiyURyo2pDtE3KtTY5OwkzJ29CEcC1yh6RX_uVYeBl-YumpUujRFcxbE7aY8rpE3ILXuBWhrJUopqVXmfrFU6AWPJvr3hcAE7L-my9wDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB5D63xeoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBDXxV7SCAkIgOGAEBABGF-ACgHICwHYEw3QFQGYFgGAFwGyFxwKGggAEhRwdWItNjA4MjIyNjA4Mjc5MzU4OBgA&sigh=DW3U0rJ1mxY&uach_m=[UACH]&template_id=419

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&slotname=9795689928&adk=165382125&adf=2004953962&pi=t.ma~as.9795689928&w=770&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&psa=0&format=770x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176013&bpp=3&bdt=663&idt=183&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=615&ady=20&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=xWV7T5aaD2&p=https%3A//blogtuan.info&dtd=188
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 29 Nov 2021 11:26:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame E7F5 19 KB
8 KB 137ms
136ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&slotname=9795689928&adk=165382125&adf=2004953962&pi=t.ma~as.9795689928&w=770&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&psa=0&format=770x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176013&bpp=3&bdt=663&idt=183&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=615&ady=20&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=xWV7T5aaD2&p=https%3A//blogtuan.info&dtd=188

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:25:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:25:41 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame E7F5 2 KB
1 KB 140ms
140ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:24:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:24:34 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E7F5 119 KB
36 KB 104ms
104ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame E7F5 15 KB
6 KB 140ms
140ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame FEC9 3 KB
579 B 47ms
47ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 09:52:04 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 29 Nov 2021 11:26:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H2 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame FEC9 1 KB
914 B 121ms
121ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:22:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 238
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:22:19 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame FEC9 19 KB
8 KB 116ms
115ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:25:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 36
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:25:41 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame FEC9 2 KB
1 KB 121ms
120ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:24:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 103
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:24:34 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FEC9 119 KB
36 KB 107ms
106ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame FEC9 15 KB
6 KB 117ms
117ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H2 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame FEC9 27 KB
11 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 12:44:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254517
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 24 Feb 2022 12:44:20 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A254 12 KB
9 KB 114ms
66ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021111601&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

337b942cad3d7fee9a6780c3c90d4a884d98b1788d97ae2e5fcd74da67fc0b9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9169
x-xss-protection: 0

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5634381235701396983/ Frame 6042 2 KB
2 KB 84ms
37ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5634381235701396983/downsize_200k_v1?w=100&h=100

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29a0f51b881e8ff45a6e870d5738fa0f9b785877f5b22e9ffddf911ee09bfc54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 28 Nov 2021 11:21:13 GMT
x-content-type-options: nosniff
age: 86704
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1648
x-xss-protection: 0
last-modified: Thu, 20 May 2021 07:42:06 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 28 Nov 2022 11:21:13 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6042 0
0 83ms
82ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CvX-G2LikYeLhEK3P1fAPlIKNmAqbgJbhZsfO58eCD829y6GaGhABILKy4YsBYJXikIKgB6AB6MSAuALIAQGpAi_hbKEUwnU-qAMBqgTOAU_QxIXli6CWKVILvAChIbylv92hDJKnJcTliWCcd0pEi8ERkHfB5fiTMMWnrSH5VnzgREWKGoMAlkoZM8zWL54PzFfoEKgPgKkR8Ks8ToBsiUi4IUU6VCjP3JtRtyugGFo41L1QStFZvQf54GA5g_7qFLRbbOxq7XtG4PZsoONFVa6sdGVUzxJO_eX_1uun2iwfCFZIg2eX-Bt5VXicYIJVrvc0rNuRNLuXB9VT5wn7shPGNujrc-30BDWibuFO5pSp5gsB4rDKCWG62p3YwATLibjI4wOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAYAHgLv_xwGoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCgkAvSCAkIgOGAEBABGF-ACgHICwHYEwrQFQGAFwGyFxwKGggAEhRwdWItNjA4MjIyNjA4Mjc5MzU4OBgA&sigh=iJmvKFLvT7o&uach_m=[UACH]&template_id=5001

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 29 Nov 2021 11:26:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D0F4 143 B
163 B 40ms
39ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 29 Nov 2021 10:58:25 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1672
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 462C 6 KB
3 KB 86ms
40ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Mon, 29 Nov 2021 11:26:17 GMT
expires: Tue, 29 Nov 2022 11:26:17 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 6042 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebd5b3174abe5ab4fde661f3cc28fcf6cf4efff42a8a1424731c280063f31f34

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enabler.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 272F 16 KB
6 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 28 Nov 2021 23:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 43070
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5866
x-xss-protection: 0
server: cafe
etag: 544157900006238945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 29 Nov 2021 23:28:27 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 272F 26 KB
10 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 28 Nov 2021 16:13:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69158
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Mon, 29 Nov 2021 16:13:39 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4CAE 143 B
163 B 41ms
41ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&slotname=9795689928&adk=165382125&adf=2004953962&pi=t.ma~as.9795689928&w=770&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&psa=0&format=770x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176013&bpp=3&bdt=663&idt=183&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=615&ady=20&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=xWV7T5aaD2&p=https%3A//blogtuan.info&dtd=188

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 29 Nov 2021 10:58:25 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1672
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E7F5 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 384035ac9b791ce3be1ffb6341bf6f5a75a997d0941927f592a65d869548b47a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3232 143 B
163 B 40ms
39ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 29 Nov 2021 10:58:25 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1672
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A254 17 KB
6 KB 63ms
63ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111601.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame D0F4
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

104ms
99ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 css
fonts.googleapis.com/ Frame 77DE 4 KB
619 B 52ms
52ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3049379357&adf=1527168045&pi=t.aa~a.2856682273~rp.3&w=390&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=390x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280&nras=2&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=964&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2qEYZ2tmCW&p=https%3A//blogtuan.info&dtd=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 09:47:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 29 Nov 2021 11:26:17 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 77DE 1 KB
880 B 40ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:22:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 238
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:22:19 GMT

GET
DATA 200
OK truncated
/ Frame 272F 41 KB
41 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67e050fa430a598965efa83b430a7eaa470b4187fce0a65b70dd3cb34dbebcd3

Request headers

Referer
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
DATA 200
OK truncated
/ Frame 272F 46 KB
46 KB Font
application/octet-stream

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: af4fa13d9c2e8d0e1449708b04a3bbac146094c0bcd926b1e15833223699b834

Request headers

Referer
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: application/octet-stream

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FB02 624 B
297 B 52ms
52ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY2OOpXTAB&v=APEucNXmo5wOJt38zMHx48a0bp4A7VuWS3VAT0nWxKnk-cNtHQSPxdpQpFaY_3bPGT1zAjC9GLdM1D3W2jDMO4QeH8pKuQ-v6Hq5PZHytxNEfblktYMCO5Chtvple6TSFA_3moX9meiJKl29VcAM8iWrwtVKZrZZ6K8a-x5KA9Sh-E9zEGgztDQ

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 462C 24 KB
14 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CGUmQG7QRTi_MZd6xhp_kfAnWu3RhYAlBhOdG4Qwc3Rm03LoYu_TaU31d8ogb0amtOTcbNOOBKTNPS9nCeDi7ChPQTlXflimc9izVxiLqSTU-24dU0s78amQLNmem98FKMLCFDixjAFRdEev-okJ8H8Pbd1w&cry=1&dbm_d=AKAmf-BWBlfvlnmY-AWJtrdjyY45hq8Hh928a0sWmDDiIff7X83673ZJ6eeZbiM_dXKHaHTl8w4jvbv5AnOz5tHaGVVTQOaMF32invuJ1DjPKVq92sRZXhJ6GPR3t9bvBTU1rGbMkSLbsZFcorZrHQs8xPtQTFoCrwXVWVExadOUQxHgc4oJGAMjqqlz_YzGufSIt2cI8zskkdNs1UwGC0BoZeqmOuxiizVCYezB1JqE78aGZ-dTLqI7NhbdgfzeEhtxN_Eky4K18DB9QhgEbGw-hfYUzIqMoSS-SnhtMwkU-khcYm9J-7pmDOg6UU9WpBTjHVG1JGfhQzZJm-n_GIhMez933cgR1wG7JQi9oIesXJY6aOO28yFNXNGBuCQox-h0bLNAUCAGI9WOjcEG9EMpKcdbSFy6e6pxKuv4qBLDCMW1vf4WsQQxiMYopYaRfi3Kt0NKlQXqOnA0ZZJyPvwSEo_abO25IxsXf8AJwkKgToTPIjyiAFTxasS9AUDTcyfF90dyo8hsXMaY7p_YVY1ieMI4EJM7S0Cy05VrKBpaN4vc7YW07wkEaWNNdS1Pezs_PYmnLF6dbLw6X1nBIbxiWe-_0CeQPkWQ7d5k0yevZycV0n_vncqqObweNhe5KeuGwpULVq9hHSy7HN7G_eRC9yAtGUj0pHlcwsC_liq0vZ_BAlP7AtJRyig_RhM1RzMaQpHd-YwbihEulh-kIuSxoH8BaNJCwlcjHMfmySlga8hf_sxbrckZc4UsURFfA1s4ykgVW1IcfCm_jWCHC2D2eO1b9wMww8EcITSCDP3tSbfnNqGKyRSP2plZ1P7GOo-VbhcpTOPPR2zNHd6JO6vpXvdBpncn5-LLQ6r_vXdCNHhRhuO--1Sb3DvgiWk52J2NYF3EoIMHkJDlExmd6r5U4Ql0KYb5ro7ZdvHNrwRiAofH44oxpYBfPnxdRdG69Qrdd09dl_pRL6ojxZ0nECL_ZU2rxvPIKKDRjFTqma3iQA-bKofDTLRPvOsLTRWxwyli_7IgxVhNMXsbEdLVmPmjeoJRV-Zmb8gTSbBJqYsGc8k6Me-DwEvEyd2gF0QEI6C3IQx0iEdETupe5x4BFDlPgLHzfdNDfc15Qf7bJYP_yq8J-DGsFGDXVs0NSGe6RRDG_IjujJPvCB2oUjeyTCTMyzOHGErsnrAbsY1jqSk0YjZzdMZ84mvrcqct46eQSDKZR0B8tra2FoAibfGLNEMGETIVxL63bT_1do4Gj4yNkBEkvPet-nKzTafEr3B3DVUGRiSu6NbL2l2ZRtk1kGFcBWLSxbKv4ouLgfu4O0SKx2KQ5Q6Y9ZK4mOyr9uyvQnS3KcAlYTOe15qiJJF21molkgjgcIbRWPcKsqb_yeNEtpRtjiehbyZCIBj8gm2TfUad_YRznHJ-TKI4VURLhmsAukoFY0cW5F5Y6YzV3pt79G5_P7Nc-pFF9YVsHGNgJEp8Eyc7kEgvdtoMs43Rmt28rsrKkTVOIZsNpVAnVSR_coaInzIUXGlXFDOfNi9Q2PKxmxHGViKxgHk81xLptg3UwDd9D5GSH9Bf8731TRP4vIJ88B90RJBgbWqN5oQHsfvY0OLlS0hqfochTYotVOEO3-5UP2vFgdgd6DdDPGOxc5tBsKHja1JT2TwsLl7OC6jzmBHYdlU3_mST1Mkg_Oqdfmk-sHf3aMlVXmGHMkg9VubmUs4PqXisqOPE01Izw4Cv3ZCFJitOa6VLi1Y42PxWDpiJ1Tht7dlmjWyfugJWRx0YdfXSRs6CsVUtWqgkuQLJ5RRvL8u2M9CcPo5GxKh45ly5xPQQxz825bliY9VoLiu55w7UfsqXdK7hecVnDG9hMwAKuJvFrinYjVdT-Pi6uAFm24aGKPV1ry374yqSt2ybc4EhADByRPV_zn2fQrOv0v_y5Vr4ZxicSs71EA6pH7Gt-VMojLUG6NNlOcoGDl9D3CTwO6i_HPr2r10cSnM7N6XiODcbyeg8uVg5eJhxYwrX-Q_zNlhwxTLEtuKc_TSJ6U8qdT3t3j7b5ZOHFeEpDtHiuN7Qd0eIq_KDcorDbMKpwSiswEsU9zSPCSFLok_5ZiI0qoUIuRySVOxBdr3LB6-rPGG4cu-p2-Dg1MZyjfJZMEg8fk5TWcky3EpsC-7vumqNxo7Wo67vxTF_1NogBrCRThn_flQ9k_orGvtNmswEM4IyTIIssQnmEUc4KDoYP0mTGFbhLceM1nFm1n-0PzDPm4pp9-kBKhE_V1BOAYXH0X9uXsSyNqH7LG6WmTVJdCGl6dim-KxgmXNMz-OmrjbrpmSuLlmHB-8dl2P5dL7Rv5SLiWpINhYwiB-H8bZiOgVfS8uJe8lwffHTOIWlYLxZjmXGCFmXIF8BLvdXNYyUTTCSLG9orCu-Tj_qs4hqvfN-61W9iDZtAeZlioJNUywBetrl7dfhRo04nfX4tkEuU4qmL3yh1i8mDMqotWBouj4GLKSSORStJ6EZVhOEBo_Dl37IBxakXrwLxl-WcaVmju3FFwzspVvHdwuCXuR8eV_hU0wk75J8jUhqj85nd519HpCXIF7V4sHd9604QAha0UuIOoAvxRYn3TrLFGsKsHvQ0cZa2U1xxBXG_SCD3-FEF8ndXEmERrL1IKTBPXlE8eMMkytyMsGDRuLQuWVuUxEnsTFvTg1rqikNS9PE9T25W4gEDl-aAmZH3ubqJAgRtqq3cp_i2HHsp3-Z2cU0sZRgmKJTNqEARhmWzsSMQA6LBtq1ZelPf_yn3m7Hj5-l6w7xPPrwAltsk0SvoedZM-ZOGLjeX4fYhPnMy3SooXYsGxxQ1LYfVx_7ljU0u0LpnJ4d9fdkVR4WY8GISFEjyNaEgvP51ma7gGfkkTqhHRPVSxvK3sjQQjY_5IdtDX7p4KI52GMhCSMmLY6SwvbaVh14c3Grc6d-OvCI1PFUpwA35GWekIg7TwXd9xM4xeWtGl7gXdfwasBcjUZjoK0XYW7xLk2wfLyu8ff3c_CNxycY8zqFff614o2WkBkZoq5k-NC_WzP8NqSFtQLefMnyooP1kC3zpJxCE1hjwwvp7GFqhQ9oyyelbSzGwp8lLQ6alaCcUbD4ChEjlQEi_wYfpSkdbTW53Jj-1XstcbXeTobe9br1eMHtvNaMVJw6uJb2YGVd6ZEUtavu_SepnMoozOqdhdnq8d1Xx7RLV5pO6oalXPEgZ4VVKaX3dMU2sXuds4qdyksV9ocPxPH32WLzUWyrJGJxBFHlpYWYkqA5HWviHnZT&cid=CAASEuRod_F1ewIynux5YygVmGPvOA&rfl=2%2Chttps%253A%252F%252Fblogtuan.info%242%2Chttps%253A%252F%252Fwww.foxpush.com%252F%240

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f161d1e2738e7df5c56ad6bf74314b0081e8ca6111cdf369c11ad0bb8af5795e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14626
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 462C 42 B
63 B 72ms
72ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B6jBA2ZoFMAvtqMGLe_B7x1B_4y3mjTBP0uIIjcu2dPaBhrqa6_iOnK8l36TV07VlCCdcI0D7-IU7LosDd6WVnxSuy_JqlHOt6wn8etHAuahRImrk

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 462C 2 KB
1 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:11:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 462C 119 KB
36 KB 98ms
51ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 462C 15 KB
6 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 462C 0
0 114ms
47ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRDl0GH8P_IkvvULSD8wlpLQBMr8JqKU-6_xiMinA_tw5ejZM4xALoGoYHF5HjXWiFw0rN6EAS0utEIH99BqvbEWnYFYw
Requested by: Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 77DE 19 KB
8 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 368
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:20:09 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 77DE 2 KB
1 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:11:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 77DE 119 KB
36 KB 108ms
66ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 77DE 15 KB
6 KB 45ms
45ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 77DE 0
0 109ms
47ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSG0cEU9r8RFjQaWz_t9VSl5gpzi5uCVYOn-tqPTy10BT5Vo0bjh_IlwWeO06_iWHiagPyYNhyk23RvBgosHItXyZGVZA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3049379357&adf=1527168045&pi=t.aa~a.2856682273~rp.3&w=390&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=390x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280&nras=2&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=964&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2qEYZ2tmCW&p=https%3A//blogtuan.info&dtd=15
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame 77DE 27 KB
11 KB 81ms
37ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 12:44:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254517
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 24 Feb 2022 12:44:20 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/5464085534067046440/ Frame 77DE 13 KB
13 KB 40ms
40ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/5464085534067046440/downsize_200k_v1?w=400&h=209

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6858766264eaec19d6f93a6e160014266b50fcb8f3f2097c098c43c77104a977

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sat, 27 Nov 2021 12:20:09 GMT
x-content-type-options: nosniff
age: 169568
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13505
x-xss-protection: 0
last-modified: Fri, 19 Nov 2021 15:40:02 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 27 Nov 2022 12:20:09 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/3727159244835447219/ Frame 77DE 2 KB
2 KB 54ms
54ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3727159244835447219/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

95de106c01707b82d40919a0e7f851181b1ec59dc117ca98146b84f72c522b32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 21:39:35 GMT
x-content-type-options: nosniff
age: 222402
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1788
x-xss-protection: 0
last-modified: Mon, 15 Nov 2021 11:27:34 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 26 Nov 2022 21:39:35 GMT

GET
DATA 200
OK truncated
/ Frame 77DE 209 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 341e9d729c15243d48439078e9e039a5797f01b5a74ec78da7886cf3f9c74879

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 77DE 0
0 81ms
81ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CZpil2LikYaHiOY_dbbjpnqgMmeqD1Wbs746ujw_hrZnLkw4QASCysuGLAWCV4pCCoAegAYTyk5EDyAEJqQI9UZ7Elf2yPqgDAcgDywSqBO8BT9Aw4iPKA8W3nfKdTTSWOzypoVI8KaHkZkKuI6TrNOPjQzM4dHJWXyw5qo0GPgEBZJyeMCC3LALZfh1lb2CotHWMbO-srbnp2W6LhB_JimcZFQFLM3-W9KLGelS1K2m7KFSf2rEQG0PuhNCgWwq7YCITBF3eX6p6oeJK5zwBA-PaF3GsXXW8iXm_xXebFM1tB6E66tHnU8_QtZfhTJFXTAtfhsB6JfsLrglxMVeZFhS3_pzimlExWp6euzzS0cY_j7ydPGjwhvWK9mXB-_wLuuMTJpvQINaDKev9XOnXiW8Wcdyz6DP97yEgrR0c1bnABNGu4tTpA5IFBAgEGAGSBQQIBRgEoAYugAfa7sB1qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQpuIk0ggJCIDhgBAQARhfgAoByAsB2BMM0BUBgBcBshccChoIABIUcHViLTYwODIyMjYwODI3OTM1ODgYAA&sigh=J0v1T2BWE2g&uach_m=[UACH]&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3049379357&adf=1527168045&pi=t.aa~a.2856682273~rp.3&w=390&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=390x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280&nras=2&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=964&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2qEYZ2tmCW&p=https%3A//blogtuan.info&dtd=15
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 29 Nov 2021 11:26:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 001A 12 KB
5 KB 39ms
38ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Mon, 29 Nov 2021 06:48:04 GMT
expires: Tue, 29 Nov 2022 06:48:04 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 16693
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame FA30 783 B
1001 B 84ms
49ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

89ba0fb4732c2ca0860b96597695e0ab61eaa7db61bd2a3af2a193e742e955c4

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-LKUkBOOwSfmckOo4A/gQsA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Mon, 29 Nov 2021 11:26:17 GMT
date: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-LKUkBOOwSfmckOo4A/gQsA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 4CAE
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

138ms
135ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 272F 35 KB
13 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16693
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 3232
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

161ms
158ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:17 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 logo_left.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/ Frame 272F 8 KB
8 KB 41ms
39ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/logo_left.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b4d55998ccab91a3ed4dfab41874036cccdc8463e44e5817ff0021d3f9bba272

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 431494
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8235
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 11:08:22 GMT
server: sffe
date: Wed, 24 Nov 2021 11:34:43 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Nov 2022 11:34:43 GMT

GET
H3 200 layer.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/ Frame 272F 6 KB
6 KB 45ms
42ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/layer.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c7719cb7bebb42425a9f17e277409d0c316e112c8eb03323bf5b0b008eb80c7e

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 519747
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6553
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 11:08:22 GMT
server: sffe
date: Tue, 23 Nov 2021 11:03:50 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 23 Nov 2022 11:03:50 GMT

GET
H3 200 background.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/ Frame 272F 29 KB
29 KB 48ms
45ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/14795368434310693961/background.jpg

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca1651121a8fee2a9749912440d1ccfa3d2781ce7fdb4f9f898225540ec67c3f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 475569
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29296
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 11:08:22 GMT
server: sffe
date: Tue, 23 Nov 2021 23:20:08 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 23 Nov 2022 23:20:08 GMT

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 6541 35 KB
13 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16693
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5174 1 KB
749 B 39ms
39ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 13:26:12 GMT
expires: Mon, 29 Nov 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 79205
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FB02
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC8sdSNEnAtIlHgn9c5R-bw&google_cver=1

43 B
894 B

38ms
38ms

Image
image/gif

184.51.9.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC8sdSNEnAtIlHgn9c5R-bw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY2OOpXTAB&v=APEucNXmo5wOJt38zMHx48a0bp4A7VuWS3VAT0nWxKnk-cNtHQSPxdpQpFaY_3bPGT1zAjC9GLdM1D3W2jDMO4QeH8pKuQ-v6Hq5PZHytxNEfblktYMCO5Chtvple6TSFA_3moX9meiJKl29VcAM8iWrwtVKZrZZ6K8a-x5KA9Sh-E9zEGgztDQ
Protocol: HTTP/1.1
Server: 184.51.9.98 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:17 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 29 Nov 2021 11:26:17 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC8sdSNEnAtIlHgn9c5R-bw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FB02
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YaS42enVbr8Gi.MWeoCQnwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECLySA6U-qfb1TorRca7hUM&google_cver=1&google_hm=2

43 B
894 B

74ms
44ms

Image
image/gif

184.51.9.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECLySA6U-qfb1TorRca7hUM&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY2OOpXTAB&v=APEucNXmo5wOJt38zMHx48a0bp4A7VuWS3VAT0nWxKnk-cNtHQSPxdpQpFaY_3bPGT1zAjC9GLdM1D3W2jDMO4QeH8pKuQ-v6Hq5PZHytxNEfblktYMCO5Chtvple6TSFA_3moX9meiJKl29VcAM8iWrwtVKZrZZ6K8a-x5KA9Sh-E9zEGgztDQ
Protocol: HTTP/1.1
Server: 184.51.9.98 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:17 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 29 Nov 2021 11:26:17 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESECLySA6U-qfb1TorRca7hUM&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame FB02
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELL0GektZZuxckupEdYNgDU&google_cver=1

43 B
1008 B

7ms
7ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESELL0GektZZuxckupEdYNgDU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsY2OOpXTAB&v=APEucNXmo5wOJt38zMHx48a0bp4A7VuWS3VAT0nWxKnk-cNtHQSPxdpQpFaY_3bPGT1zAjC9GLdM1D3W2jDMO4QeH8pKuQ-v6Hq5PZHytxNEfblktYMCO5Chtvple6TSFA_3moX9meiJKl29VcAM8iWrwtVKZrZZ6K8a-x5KA9Sh-E9zEGgztDQ

Protocol

HTTP/1.1

Server

37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:17 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 64ef87e8-179b-4e72-9bcc-274e3785a056
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELL0GektZZuxckupEdYNgDU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FB02
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D

170 B
243 B

192ms
62ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:17 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: b2e1570e-3689-466b-b15c-2954325c3813
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 462C 24 KB
9 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CGUmQG7QRTi_MZd6xhp_kfAnWu3RhYAlBhOdG4Qwc3Rm03LoYu_TaU31d8ogb0amtOTcbNOOBKTNPS9nCeDi7ChPQTlXflimc9izVxiLqSTU-24dU0s78amQLNmem98FKMLCFDixjAFRdEev-okJ8H8Pbd1w&cry=1&dbm_d=AKAmf-BWBlfvlnmY-AWJtrdjyY45hq8Hh928a0sWmDDiIff7X83673ZJ6eeZbiM_dXKHaHTl8w4jvbv5AnOz5tHaGVVTQOaMF32invuJ1DjPKVq92sRZXhJ6GPR3t9bvBTU1rGbMkSLbsZFcorZrHQs8xPtQTFoCrwXVWVExadOUQxHgc4oJGAMjqqlz_YzGufSIt2cI8zskkdNs1UwGC0BoZeqmOuxiizVCYezB1JqE78aGZ-dTLqI7NhbdgfzeEhtxN_Eky4K18DB9QhgEbGw-hfYUzIqMoSS-SnhtMwkU-khcYm9J-7pmDOg6UU9WpBTjHVG1JGfhQzZJm-n_GIhMez933cgR1wG7JQi9oIesXJY6aOO28yFNXNGBuCQox-h0bLNAUCAGI9WOjcEG9EMpKcdbSFy6e6pxKuv4qBLDCMW1vf4WsQQxiMYopYaRfi3Kt0NKlQXqOnA0ZZJyPvwSEo_abO25IxsXf8AJwkKgToTPIjyiAFTxasS9AUDTcyfF90dyo8hsXMaY7p_YVY1ieMI4EJM7S0Cy05VrKBpaN4vc7YW07wkEaWNNdS1Pezs_PYmnLF6dbLw6X1nBIbxiWe-_0CeQPkWQ7d5k0yevZycV0n_vncqqObweNhe5KeuGwpULVq9hHSy7HN7G_eRC9yAtGUj0pHlcwsC_liq0vZ_BAlP7AtJRyig_RhM1RzMaQpHd-YwbihEulh-kIuSxoH8BaNJCwlcjHMfmySlga8hf_sxbrckZc4UsURFfA1s4ykgVW1IcfCm_jWCHC2D2eO1b9wMww8EcITSCDP3tSbfnNqGKyRSP2plZ1P7GOo-VbhcpTOPPR2zNHd6JO6vpXvdBpncn5-LLQ6r_vXdCNHhRhuO--1Sb3DvgiWk52J2NYF3EoIMHkJDlExmd6r5U4Ql0KYb5ro7ZdvHNrwRiAofH44oxpYBfPnxdRdG69Qrdd09dl_pRL6ojxZ0nECL_ZU2rxvPIKKDRjFTqma3iQA-bKofDTLRPvOsLTRWxwyli_7IgxVhNMXsbEdLVmPmjeoJRV-Zmb8gTSbBJqYsGc8k6Me-DwEvEyd2gF0QEI6C3IQx0iEdETupe5x4BFDlPgLHzfdNDfc15Qf7bJYP_yq8J-DGsFGDXVs0NSGe6RRDG_IjujJPvCB2oUjeyTCTMyzOHGErsnrAbsY1jqSk0YjZzdMZ84mvrcqct46eQSDKZR0B8tra2FoAibfGLNEMGETIVxL63bT_1do4Gj4yNkBEkvPet-nKzTafEr3B3DVUGRiSu6NbL2l2ZRtk1kGFcBWLSxbKv4ouLgfu4O0SKx2KQ5Q6Y9ZK4mOyr9uyvQnS3KcAlYTOe15qiJJF21molkgjgcIbRWPcKsqb_yeNEtpRtjiehbyZCIBj8gm2TfUad_YRznHJ-TKI4VURLhmsAukoFY0cW5F5Y6YzV3pt79G5_P7Nc-pFF9YVsHGNgJEp8Eyc7kEgvdtoMs43Rmt28rsrKkTVOIZsNpVAnVSR_coaInzIUXGlXFDOfNi9Q2PKxmxHGViKxgHk81xLptg3UwDd9D5GSH9Bf8731TRP4vIJ88B90RJBgbWqN5oQHsfvY0OLlS0hqfochTYotVOEO3-5UP2vFgdgd6DdDPGOxc5tBsKHja1JT2TwsLl7OC6jzmBHYdlU3_mST1Mkg_Oqdfmk-sHf3aMlVXmGHMkg9VubmUs4PqXisqOPE01Izw4Cv3ZCFJitOa6VLi1Y42PxWDpiJ1Tht7dlmjWyfugJWRx0YdfXSRs6CsVUtWqgkuQLJ5RRvL8u2M9CcPo5GxKh45ly5xPQQxz825bliY9VoLiu55w7UfsqXdK7hecVnDG9hMwAKuJvFrinYjVdT-Pi6uAFm24aGKPV1ry374yqSt2ybc4EhADByRPV_zn2fQrOv0v_y5Vr4ZxicSs71EA6pH7Gt-VMojLUG6NNlOcoGDl9D3CTwO6i_HPr2r10cSnM7N6XiODcbyeg8uVg5eJhxYwrX-Q_zNlhwxTLEtuKc_TSJ6U8qdT3t3j7b5ZOHFeEpDtHiuN7Qd0eIq_KDcorDbMKpwSiswEsU9zSPCSFLok_5ZiI0qoUIuRySVOxBdr3LB6-rPGG4cu-p2-Dg1MZyjfJZMEg8fk5TWcky3EpsC-7vumqNxo7Wo67vxTF_1NogBrCRThn_flQ9k_orGvtNmswEM4IyTIIssQnmEUc4KDoYP0mTGFbhLceM1nFm1n-0PzDPm4pp9-kBKhE_V1BOAYXH0X9uXsSyNqH7LG6WmTVJdCGl6dim-KxgmXNMz-OmrjbrpmSuLlmHB-8dl2P5dL7Rv5SLiWpINhYwiB-H8bZiOgVfS8uJe8lwffHTOIWlYLxZjmXGCFmXIF8BLvdXNYyUTTCSLG9orCu-Tj_qs4hqvfN-61W9iDZtAeZlioJNUywBetrl7dfhRo04nfX4tkEuU4qmL3yh1i8mDMqotWBouj4GLKSSORStJ6EZVhOEBo_Dl37IBxakXrwLxl-WcaVmju3FFwzspVvHdwuCXuR8eV_hU0wk75J8jUhqj85nd519HpCXIF7V4sHd9604QAha0UuIOoAvxRYn3TrLFGsKsHvQ0cZa2U1xxBXG_SCD3-FEF8ndXEmERrL1IKTBPXlE8eMMkytyMsGDRuLQuWVuUxEnsTFvTg1rqikNS9PE9T25W4gEDl-aAmZH3ubqJAgRtqq3cp_i2HHsp3-Z2cU0sZRgmKJTNqEARhmWzsSMQA6LBtq1ZelPf_yn3m7Hj5-l6w7xPPrwAltsk0SvoedZM-ZOGLjeX4fYhPnMy3SooXYsGxxQ1LYfVx_7ljU0u0LpnJ4d9fdkVR4WY8GISFEjyNaEgvP51ma7gGfkkTqhHRPVSxvK3sjQQjY_5IdtDX7p4KI52GMhCSMmLY6SwvbaVh14c3Grc6d-OvCI1PFUpwA35GWekIg7TwXd9xM4xeWtGl7gXdfwasBcjUZjoK0XYW7xLk2wfLyu8ff3c_CNxycY8zqFff614o2WkBkZoq5k-NC_WzP8NqSFtQLefMnyooP1kC3zpJxCE1hjwwvp7GFqhQ9oyyelbSzGwp8lLQ6alaCcUbD4ChEjlQEi_wYfpSkdbTW53Jj-1XstcbXeTobe9br1eMHtvNaMVJw6uJb2YGVd6ZEUtavu_SepnMoozOqdhdnq8d1Xx7RLV5pO6oalXPEgZ4VVKaX3dMU2sXuds4qdyksV9ocPxPH32WLzUWyrJGJxBFHlpYWYkqA5HWviHnZT&cid=CAASEuRod_F1ewIynux5YygVmGPvOA&rfl=2%2Chttps%253A%252F%252Fblogtuan.info%242%2Chttps%253A%252F%252Fwww.foxpush.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:24:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 100
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9475
x-xss-protection: 0
server: cafe
etag: 15988442915344899701
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:24:37 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 462C 41 KB
15 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 12:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 427061
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 24 Nov 2022 12:48:36 GMT

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 001A 35 KB
13 KB 42ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16693
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
DATA 200
OK truncated
/ Frame 77DE 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 09db7053d3f956d394751afca37d7d18acb7970f1626a1e809103d311b2d8160

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 77DE 15 KB
15 KB 86ms
39ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 17:56:19 GMT
x-content-type-options: nosniff
age: 408598
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 24 Nov 2022 17:56:19 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame AD5F 22 KB
8 KB 38ms
36ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 24 Nov 2021 12:48:37 GMT
expires: Thu, 24 Nov 2022 12:48:37 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 427060
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK 6jrsnqs01vv6 Show response
hal9000.redintelligence.net/zone/ Frame 462C 11 KB
4 KB 48ms
12ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/6jrsnqs01vv6?subid=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfH-e2bikYdHGA9uNrASgu6_YBd2t6KhgpbnU3JAK8C4QASCz8shxYJXikIKgB8gBCakC0UutODjlsj6oAwGqBOoBT9DTjlJd6p9-NV05_pHScbY8q3BaTPEcW_D8i_xy5UYbiX4C06JzC-dtmgp0DuMZX4YtYzLtPvQJJBFlTiayNU2-OAzbhQQpOWXxZ67blHvHt-K9yC2NIHdg5uI5U3aqvHBE8YV2ZnXso0dyk6VGW5ILWW28-g0sSu_MNs2J9IwSUgkgUVY_eSji6kTXsRo6vNowpxd56sAs5Yzilu3mirZz_tYCbB_hnH5_epwpWmKJAkEHkC3RREgtQ7mX1StZG0YVX_wlvS2VMSWgwsodUJPV8VXDDy3r7woLdh9WdhheaLG4w09uNRZkwATOjruxlgLgBAOQBgGgBk2AB-vn6F6oB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE57l7AzQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRod_F1ewIynux5YygVmGPvOA%26sig%3DAOD64_0uKl7BkvV71WKax0tzyCt_41Yo1g%26client%3Dca-pub-8113799588685394%26dbm_c%3DAKAmf-A4n2F1GSGwyIoQNpdGTcEHC6z2ztiLcn5EajJilc6PMo6PP_HUj-QhMnxi16JQIcP6luPWDqukLagvfwlww54LWiR5y3Q3J3zqKobL3SE4l6VumEPZfPxEqYJv1aGbi0G3gig-gJ7skMZBWstGzPfsON3SIw%26cry%3D1%26dbm_d%3DAKAmf-CadYplFh6JhdmkxUHQLlIhg_dFtxFv1UIyHZwspV3NgRYhCtFmCCaPq51HREj6RNx7KRoRXgxPww1S9A6ax8lLg-Upv-3nbyJfBmEFahRULT-DSzVqFg9uueVh1RO89NHvyVYHZI9Zk9W0HSshk79Sr_USOwp0KaU6Z9sDDfFWgwpp2PJkpUFSGjkYaFa-UjVLmacQbnKMuMr98JaDVvrANAGVvYZ4Gw866ctdSeajqQxLaPfXDcw20TJpTDV9pqcz_XrGweGc--GqdFwrxwNXQkKp1S4UZvuma3q8V-_-hGMgmZO8IibXFDlChJTfTObsQFgS_V3j-Y4zZafqSR0KTt7PCRSs-ykl2mbgP2nD-k2J28ZUhMX6jNpohdmjjmMVDhR_mMHeILIlkHt-gXsPeZMO3_qf5JgqtKRnZY769SdFcvv9C8eEOSrrv-_U7b6F8--kPB-iW2aySnHTK88_CMNZKZgj7m18eot5hFWF2gKfSjl-Gz0sqkrex73JTe4MKtAPvIcN9xAMng14ypt98ZItRO0HGgpji4XfelTasmcB1MdyXoTtBp2zCaMuu2i4PcuZ%26adurl%3D
Requested by: Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f805c4b4ccc309d7edeb70eaabd8eba3dc6281291aaae329d54bf2448c1cb771

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:17 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4006
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 9809812153932713525
tpc.googlesyndication.com/simgad/ Frame 5068 65 KB
65 KB 39ms
38ms Image
image/gif 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9809812153932713525

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=2449947586&adf=2847098451&pi=t.aa~a.2964927557~rp.2&w=383&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=383x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1541&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280&nras=5&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=3699&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wSxp47vDvn&p=https%3A//blogtuan.info&dtd=74

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

053ec5c40c5cd2fa4607dc83d1f1a6c283345d8aeb2ade1560672c2371cea91a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Tue, 23 Nov 2021 12:05:54 GMT
x-content-type-options: nosniff
age: 516023
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 66741
x-xss-protection: 0
last-modified: Mon, 15 Feb 2021 11:53:53 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 23 Nov 2022 12:05:54 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 5068 19 KB
8 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 368
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:20:09 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 5068 2 KB
1 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:11:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5068 119 KB
36 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 5068 15 KB
6 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 5068 0
0 102ms
49ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQh3gzO5nqNf4m_eDGgKwdAv15-0r477KOKmcOoYNNon2SEPFFgJNKk7KntVjvrBfKxH6aOUANf9DE3YCAb-WblXFcJ8w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=2449947586&adf=2847098451&pi=t.aa~a.2964927557~rp.2&w=383&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=383x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1541&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280&nras=5&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=3699&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wSxp47vDvn&p=https%3A//blogtuan.info&dtd=74
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 5068 27 KB
11 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0072f2a89bd32697c990a647ce4577265131df2f7d089ecef8eb14d50abdfb36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 09:50:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5734
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11327
x-xss-protection: 0
server: cafe
etag: 10656063359522146397
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 09:50:43 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5068 0
0 82ms
81ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CzxO62bikYetExoCWBMK-spAKwvmV32aR2-eV7A6wkB8QASCysuGLAWCV4pCCoAegAaLUrc4ByAEDqQI9UZ7Elf2yPqgDAcgDyQSqBN8BT9CY5NTfjbPs7HWwJxS0QZ80b9yzZR4xMd5Jon23CLoD38VUfzcDKA4aaOv6dmtw5VxTI52CqCchs_osn_wyrl7VbrCeGz7grivYy9TNyyMWUG7ze7pt3k_UAXEkGOLndov_gbnDa0UrNKsm2nwd-DuTiF1Hy9OYvxcTCw1WRiHLcVmQoqi2TCnDv5w25qL5HxGokLoZSzrlAFC3QtwA7A2vSKsaC7dhKaDe4UidrVzEf9smOzFYA_jSbzecz13jZRc3DM8Ug66zOiq0oNPHcpCMsKeYurOZZe8zULIbuMAEv_GPluUDkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgOAB8ar0rECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQv88z0ggJCIDhgBAQARhfgAoByAsB2BMN0BUBgBcBshccChoIABIUcHViLTYwODIyMjYwODI3OTM1ODgYAA&sigh=AehTWzhaV08&uach_m=[UACH]

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=2449947586&adf=2847098451&pi=t.aa~a.2964927557~rp.2&w=383&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=383x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1541&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280&nras=5&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=3699&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wSxp47vDvn&p=https%3A//blogtuan.info&dtd=74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 29 Nov 2021 11:26:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3C43 624 B
297 B 50ms
49ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiQ5uioATAB&v=APEucNWT9Q4OSFf91_7LE_LcqLNytlET-r3moTOnficDk59187UvbLkNvtXACYf0zBuCmdLnve67gK4IUqYDpoBeL9Oq-QlzFmELqp1Sf3m4ikulPZOOAd2gdMaGycRBh7pomLWaag4vTuptQ9WRCBZkicLH8wZv1EuRRGIwyFY1CGUtAHa5BtU

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=472186380&pi=t.aa~a.508084115~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=2&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280&nras=4&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=3114&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Pun8NNpk3m&p=https%3A//blogtuan.info&dtd=71

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=472186380&pi=t.aa~a.508084115~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=2&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280&nras=4&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=3114&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Pun8NNpk3m&p=https%3A//blogtuan.info&dtd=71

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 37B4 78 KB
31 KB 93ms
93ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BHpGHKb-aLQegux8TETvEgjiMkJ2exyGxiXax-n7tvenGGB5GnC9xx6uGoszpHUycBV1MEBrwX23F4EQU9KzSQFlZ53wcXB3DEQo_lVZTg4FZOh5jBc4P7MntOGCJvUwh1kLmbjz8eBA26ayOqChdLGOlMeA&dbm_d=AKAmf-BtdH049dTyHWzwL7qRn_CiR6-0pn8ia0dxCgVk4hJ78cqtMzqp6ax0ysdmeErPSeQ-EgJ5hO57qNEreEU5q_iC-OvKcwE1idb-zqW3T0U7xDoO5jpxjHJKhoD_PIT224_qMY2cleSE6MinMMicqHgqjtgeFSyyFC9QjAEauuIy7ReDJJX3jxWzmhv66lWmfvmlS6U9lhTS5i8SZNU5YIgf_eRzaX6aaCcNTpe7qhZ1RM0L_yoi2N--ISGOnOH4p-Bn4_u5JCC9U1pI21Td55d6wSKwA7gogwaNL8GDf4fk3ZO_dBILf1LmYbwSmW_42Sk0A_LoG_zcNOT4hC-EdiMI7aJp7Q1DlZfo1Thk2Rl0IC6neHbHgNMgB_ZTUXLsunF29i3V6tNMn0KIeQb2BpHFe8pgpMRJ0qs2P-cugK9rH4VpYhd0PhbQC7kfkE7Kdsp0QZT0KujV0RhulsvdxncbvD0jvDIFNzhXYauTVtfaCApDhLyCLdBy4QHKWD01eKXE6vvNlvOBVtvCoP8zu3by_8LMkfWSI6kVUDKXRliwrWZYxu5nYjwc315YfrjCTFsVhTOD4_Zkbp8x9dU37XMPXAhwYxE-ZoeQVSBpEChFpKXEWoUJ_jSVS220rJmwtIteSV3ZmNcsUf9TFwy6miln-3PArramBYYcTngSjSvevmzjderpjFVGONk8C4yhMIzJYyV7VB8k20IlkytOt3gih-ZAFSttDDBIPPtl2l6Ff2v207_mBNkaHJFsXkiV-sRiz-ZRbnC9aAP0zGT-xjKzrIDOkXHmgoKUG--4njtMBtf5eWAGLbFUsi4JgwYYgvuj2PI8TaukLd_Feb_Xbs0ASjvfvAKknJ3vd0dFJUqOU0duZPnA3upuH26lhcXQcDX47elx5ymSL3oy6wRyxYNqRFaDoW8kwbIoCj6j1aK_gjb6LvGyAF7vb17AiSgVoUdkIS4HfsoMvXSL19s1H6uGp2rjLTynfHNvrqoP9ByPwW5d8VZWgPgl2fsm7wTlHR_MQ87Q8ET5kEleSPNOe-2DY2l-MlAbYKq6rNkIaLwSlFhxKiaVIKhG-8E7xLeHgY5OuYLoBV8Arh8SijgB74CjOe14dlpDnrlIWAHjlEgCoswK5Z2va4IkjiDD3fr2bn6AmcfTlYXv52Du-lZMDN5GPdCr7A8JeikGQPHyqliLAShainpeikKb6XEHkzxbiwtFpcR-RhiJDUD8970HN1Q__jHoL2heEbs5YBkK_t4IfAVI6IEuqHMeuZl3LmZA4v506LwHHqbr7MUWu-WNCJZgBCKX6Pv2Jo__HwsMbT_U2T2SQL1SV52F3RGXm2pJV4JoIcAKcpgz9NVdDph7Cc4EoAWqTL0GzHSrE2o67XlFJs_ufr69GsiGFMdCK55HnosAVEX2y-TuUov1lp8Vt3KR-HpibBxUU9Dk7HVDPuTKHprKBnOFhD8zXmhQfKtGFssi-k7jd_e36Ki4-mOsEaXLHHATn4P8t9Nu_ccQaML6E3ppro2A9XKMr2EzhgKyIGAWT2AIUFtezR_HU28KPbyYbZsxjhjA9YlxWYXsPycb_ivjLNjsNpUiPmNzVqhwrl-fIQZU9erTG1P-H7aJDjONS9gDqDCA_DrOteRaqyb99ZlkXKgZiwPCOtIv-SRrVQQVjbpvotD1BFk9hlwE5cOghlkCEyq4PEjShXzH3qNr8rEcVGWMhjnuXwgcG5yApQlzsLIwxkoAo5nfC6ERfNZffBhmBAjTJf_OADnN85L9FbZq1DOzhQmlwMg0eqL9Ad1atU1SmrdwDDKw1noqzX-uDboOqjtnToBUfWHlWAFSW3hrf7XZlM-3j2MXzbrHcXQvJ84VIIr7uPJgkHpBJMZMGP0WR0J5soqHWL_9wEQ48IrFRQLGDw-NBPsIis8XX1jhMnwTdWoFApQJTNuWJqxdrFa5uAzogF7Avjfbu1SVufQzDvbFAGThZQ7XbOi4EAFSUOcXz7rNkYChjCKyMhFeUkspjsa4K4bAsDfIeQNMNCACrssBAvg8EFFtOyPPDvnf_FPOJ_KNgDXMbkbElLDr8TD0-f0DsHuH3ISbvuMSvLMLn7HubiMLylz38XTkLTsE3rZaqvuuaJ82sTYvYIGn_VzsTbp0UPvuZLKahbyy2ZUiW8AAJR_k41f_6DSeqCxXYZpOECKoU9yXRKvgeWWX9zapuN97SaxnK94Yz2UaOYjdF8hOdTu6V2addhDPr-SDZRCPblA2BLOFdJO6TwV6mZwc-7PEtifMx8bRmrM35CTN204dOn5Wskz3xxEu4stbNCTtf8zEw9ypcj_LlDAcX9Fgv4ip5reusUe2f5NsMRBMPjTUVJ8ntO11R31Kg0tPQ3vOJDkaxdp953wMry3CVWRMFnN_jygjGn7aPQfWzxh-D9JlhGoTHPBDYya-BUalFd-QYyEHvVzi1ymooKzUiJhT8HO-NRPfYQYfcOLNFx10ow8CFHIS7inNaO3fDsH65jn_fp0SOTU-okSWCNbZrWaH-GHa60kkG6cG2QXxHzz7UjIB6V4C3A1KJWX8gceQMBQ17vPWQipZZhEE_6mvy7x00BCJJHWDh3DNhuX6gT9Fy0493DXj9Y-lBJnC7elU_AeRvXtvMaS2xCHHki792Hr6wpsD7TY4ARryq_-lpmSbuuuP_ShPvpkeQvDvznyt729H0N12huLfq249vlMYyDpMtbO5ekps7tXIfKz-iA2M5KmXEzN-UTsuFERv7o-4xGeTvPVXdUr-B-C12gq4BA1GKCds8qkZI0JmlV1Oohq0werKVr3vFFsup_OotduOP10YaVIFABLRBLvwGA64VXkgcKh5ojBRNJzi724TSlE4w7HZOmwY9uLsnG8TOGVxyyv4nw0cD-o5P-MsZlD0XAO64a7f3XmRL08CHn7nKWwT4Gf62_gRhxlADCMEyAw1QPcG-OmmZXYYMi0i_t4fnzdWFRIpD6jyLbN4HWPoV77XBU2iIal36l5lat7BApLbmC3S&cid=CAASEuRoTkugs-ourpjmwJhpTEc-0Q&rfl=2%2Chttps%253A%252F%252Fblogtuan.info%252F%240

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6b6e17ac9ea9c86699afa3185e66887c89716d16006fb0c6edb43111846c2357

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=472186380&pi=t.aa~a.508084115~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=2&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280&nras=4&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=3114&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Pun8NNpk3m&p=https%3A//blogtuan.info&dtd=71
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31732
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 37B4 2 KB
1 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:11:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 37B4 119 KB
36 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 37B4 15 KB
6 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 37B4 0
0 90ms
49ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQBVm5197kSKhbEpoVXSfS85OeASOsfpCo5PEFZTj-R8OSmE6FDRfwQ3WN9-9LFxyzRXXSQKPLzhgEn1tH93ofdpjFXyQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=472186380&pi=t.aa~a.508084115~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=2&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280&nras=4&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=3114&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Pun8NNpk3m&p=https%3A//blogtuan.info&dtd=71
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 37B4 42 B
63 B 71ms
71ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CIJy0pwc9CTu_sy11WuZIumL-wRWNkf6UudPBOY9yPJUwjYJPBjxz-cKHyP070qHY25LRND64aBb9pKFqo9uYVsdEgmYcnoZCH23b7aT3eLLvl9CA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5174
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIleHfxJRrKllOeZbtfDtVJSkVqjzGQ6I3yfED...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJRQUFCREI4TXdZNg&google_push=AYg5qPIleHfxJRrKllOeZbtfDtVJSkVqjzGQ6I3yfEDNZ3rPtNdvm-7-zeFrxfN52RSzb7UQH7z23Gz3dc0O7tcJFxqSRarMRutK

170 B
188 B

63ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJRQUFCREI4TXdZNg&google_push=AYg5qPIleHfxJRrKllOeZbtfDtVJSkVqjzGQ6I3yfEDNZ3rPtNdvm-7-zeFrxfN52RSzb7UQH7z23Gz3dc0O7tcJFxqSRarMRutK

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJRQUFCREI4TXdZNg&google_push=AYg5qPIleHfxJRrKllOeZbtfDtVJSkVqjzGQ6I3yfEDNZ3rPtNdvm-7-zeFrxfN52RSzb7UQH7z23Gz3dc0O7tcJFxqSRarMRutK
Date: Mon, 29 Nov 2021 11:26:17 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5174
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESEHFBOi2d7_Fo_wE_1ziKzms&google_cver=1&google_push=AYg5qPLtMi_GyrOxz1uVhD_A69V5qggnkQGu91ftk5VAvwZj-4V5xBkhFAz24HH5XSj93hBGZPPwVO6OIbRCH1F5csMyoUjyoaI
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLtMi_GyrOxz1uVhD_A69V5qggnkQGu91ftk5VAvwZj-4V5xBkhFAz24HH5XSj93hBGZPPwVO6OIbRCH1F5csMyoUjyoaI&google_hm=Q0FFU0VIRkJPaTJkN19Gb1...

170 B
188 B

62ms
62ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLtMi_GyrOxz1uVhD_A69V5qggnkQGu91ftk5VAvwZj-4V5xBkhFAz24HH5XSj93hBGZPPwVO6OIbRCH1F5csMyoUjyoaI&google_hm=Q0FFU0VIRkJPaTJkN19Gb193RV8xemlLem1z

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:17 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPLtMi_GyrOxz1uVhD_A69V5qggnkQGu91ftk5VAvwZj-4V5xBkhFAz24HH5XSj93hBGZPPwVO6OIbRCH1F5csMyoUjyoaI&google_hm=Q0FFU0VIRkJPaTJkN19Gb193RV8xemlLem1z
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5174
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

63ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI0EZJeX1WTI5BcJdsblObP9oAngLway9GAcjDiVb2FBIZdauyxcgoXxMw0CKYXQxIquLD7lsh3ywO2WnYlHSLEUO-ZpSLm

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPI0EZJeX1WTI5BcJdsblObP9oAngLway9GAcjDiVb2FBIZdauyxcgoXxMw0CKYXQxIquLD7lsh3ywO2WnYlHSLEUO-ZpSLm
date: Mon, 29 Nov 2021 11:26:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5174
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESED3gIymcIEX1HV00plOgEho&google_cver=1&google_push=AYg5qPJmpJmx2z6O2MZFMN2EP6DNJzc_HzGGTZWm556Pzwcby1STPrJG9rCBJHH9IocgeE7yowS...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQMVQtMjMtR1lGSA==&google_push=AYg5qPJmpJmx2z6O2MZFMN2EP6DNJzc_HzGGTZWm556Pzwcby1STPrJG9rCBJHH9IocgeE7yowSn-8QbSs8H2OQBZUTlmtge7nKZ

170 B
188 B

64ms
64ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQMVQtMjMtR1lGSA==&google_push=AYg5qPJmpJmx2z6O2MZFMN2EP6DNJzc_HzGGTZWm556Pzwcby1STPrJG9rCBJHH9IocgeE7yowSn-8QbSs8H2OQBZUTlmtge7nKZ

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQMVQtMjMtR1lGSA==&google_push=AYg5qPJmpJmx2z6O2MZFMN2EP6DNJzc_HzGGTZWm556Pzwcby1STPrJG9rCBJHH9IocgeE7yowSn-8QbSs8H2OQBZUTlmtge7nKZ
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 5174
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEFJ8Jf69f1MZ1nVbPgtpKE8&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPJJ_CzSMq6WR5Px9jDUaT_PL5yz9uTutGDmxxfiS64gd4fOiquSj9UMeGCWqG1QV7kOps3s...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 5174 43 B
297 B 482ms
22ms Image
image/gif 2a05:d01c:1d8:8101:fca3:6f47:214a:2d54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESENGQjkECucdmQW0zrojPkUQ&google_cver=1&google_push=AYg5qPIX2EUyAENaSkWy-9MKOM05mpMqDK_rRdI1nYOw8GxreQfs5K0bd2SKPaY9yJjrmnNsAD0Dl_r4TzWQZO8dCEQ1pKHSE6ZV
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3049379357&adf=1527168045&pi=t.aa~a.2856682273~rp.3&w=390&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=390x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280&nras=2&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=964&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=3&uci=a!3&btvi=1&fsb=1&xpc=2qEYZ2tmCW&p=https%3A//blogtuan.info&dtd=15
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8101:fca3:6f47:214a:2d54 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5174 0
12 B 108ms
62ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JtXR-xC18uVER-qEfHTNW1RfaCihF0t00JiSd3ChI_7wRzvYjN06l99NxHqidptw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame FA30 0
0 81ms
81ms Image
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021111601&jk=2383162639821943&rc=
Requested by: Host: blogtuan.info
URL: https://blogtuan.info/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H/1.1

200
OK

request.php Show response
hal90002.redintelligence.net/ Frame 462C
Redirect Chain

https://hal90002.redintelligence.net/request.php?zone=6jrsnqs01vv6&nw=20&renderingType=javascript&namespace=6e83604827&subid=&uid=ec3bdb5935ba25c2&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...
https://hal90002.redintelligence.net/request.php?zone=6jrsnqs01vv6&nw=20&renderingType=javascript&namespace=6e83604827&subid=&uid=ec3bdb5935ba25c2&screenSize=1600x1200&screenSizeAvail=1600x1200&cli...

3 KB
2 KB

96ms
74ms

Script
application/x-javascript

46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request.php?zone=6jrsnqs01vv6&nw=20&renderingType=javascript&namespace=6e83604827&subid=&uid=ec3bdb5935ba25c2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfH-e2bikYdHGA9uNrASgu6_YBd2t6KhgpbnU3JAK8C4QASCz8shxYJXikIKgB8gBCakC0UutODjlsj6oAwGqBOoBT9DTjlJd6p9-NV05_pHScbY8q3BaTPEcW_D8i_xy5UYbiX4C06JzC-dtmgp0DuMZX4YtYzLtPvQJJBFlTiayNU2-OAzbhQQpOWXxZ67blHvHt-K9yC2NIHdg5uI5U3aqvHBE8YV2ZnXso0dyk6VGW5ILWW28-g0sSu_MNs2J9IwSUgkgUVY_eSji6kTXsRo6vNowpxd56sAs5Yzilu3mirZz_tYCbB_hnH5_epwpWmKJAkEHkC3RREgtQ7mX1StZG0YVX_wlvS2VMSWgwsodUJPV8VXDDy3r7woLdh9WdhheaLG4w09uNRZkwATOjruxlgLgBAOQBgGgBk2AB-vn6F6oB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE57l7AzQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRod_F1ewIynux5YygVmGPvOA%26sig%3DAOD64_0uKl7BkvV71WKax0tzyCt_41Yo1g%26client%3Dca-pub-8113799588685394%26dbm_c%3DAKAmf-A4n2F1GSGwyIoQNpdGTcEHC6z2ztiLcn5EajJilc6PMo6PP_HUj-QhMnxi16JQIcP6luPWDqukLagvfwlww54LWiR5y3Q3J3zqKobL3SE4l6VumEPZfPxEqYJv1aGbi0G3gig-gJ7skMZBWstGzPfsON3SIw%26cry%3D1%26dbm_d%3DAKAmf-CadYplFh6JhdmkxUHQLlIhg_dFtxFv1UIyHZwspV3NgRYhCtFmCCaPq51HREj6RNx7KRoRXgxPww1S9A6ax8lLg-Upv-3nbyJfBmEFahRULT-DSzVqFg9uueVh1RO89NHvyVYHZI9Zk9W0HSshk79Sr_USOwp0KaU6Z9sDDfFWgwpp2PJkpUFSGjkYaFa-UjVLmacQbnKMuMr98JaDVvrANAGVvYZ4Gw866ctdSeajqQxLaPfXDcw20TJpTDV9pqcz_XrGweGc--GqdFwrxwNXQkKp1S4UZvuma3q8V-_-hGMgmZO8IibXFDlChJTfTObsQFgS_V3j-Y4zZafqSR0KTt7PCRSs-ykl2mbgP2nD-k2J28ZUhMX6jNpohdmjjmMVDhR_mMHeILIlkHt-gXsPeZMO3_qf5JgqtKRnZY769SdFcvv9C8eEOSrrv-_U7b6F8--kPB-iW2aySnHTK88_CMNZKZgj7m18eot5hFWF2gKfSjl-Gz0sqkrex73JTe4MKtAPvIcN9xAMng14ypt98ZItRO0HGgpji4XfelTasmcB1MdyXoTtBp2zCaMuu2i4PcuZ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.foxpush.com%2F&ancestorOrigins=https%3A%2F%2Fwww.foxpush.com%2Chttps%3A%2F%2Fblogtuan.info&random=2927395896062&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Requested by: Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: HTTP/1.1
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 888b614b7efb9d786012a16ea46c56bb5c41414eb433e729cae8e319e989fc2a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:17 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 94786400065214000757623011793002
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1132
Expires: Mon, 29 Nov 2021 11:26:17 +0100

Redirect headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:17 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=6jrsnqs01vv6&nw=20&renderingType=javascript&namespace=6e83604827&subid=&uid=ec3bdb5935ba25c2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfH-e2bikYdHGA9uNrASgu6_YBd2t6KhgpbnU3JAK8C4QASCz8shxYJXikIKgB8gBCakC0UutODjlsj6oAwGqBOoBT9DTjlJd6p9-NV05_pHScbY8q3BaTPEcW_D8i_xy5UYbiX4C06JzC-dtmgp0DuMZX4YtYzLtPvQJJBFlTiayNU2-OAzbhQQpOWXxZ67blHvHt-K9yC2NIHdg5uI5U3aqvHBE8YV2ZnXso0dyk6VGW5ILWW28-g0sSu_MNs2J9IwSUgkgUVY_eSji6kTXsRo6vNowpxd56sAs5Yzilu3mirZz_tYCbB_hnH5_epwpWmKJAkEHkC3RREgtQ7mX1StZG0YVX_wlvS2VMSWgwsodUJPV8VXDDy3r7woLdh9WdhheaLG4w09uNRZkwATOjruxlgLgBAOQBgGgBk2AB-vn6F6oB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE57l7AzQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRod_F1ewIynux5YygVmGPvOA%26sig%3DAOD64_0uKl7BkvV71WKax0tzyCt_41Yo1g%26client%3Dca-pub-8113799588685394%26dbm_c%3DAKAmf-A4n2F1GSGwyIoQNpdGTcEHC6z2ztiLcn5EajJilc6PMo6PP_HUj-QhMnxi16JQIcP6luPWDqukLagvfwlww54LWiR5y3Q3J3zqKobL3SE4l6VumEPZfPxEqYJv1aGbi0G3gig-gJ7skMZBWstGzPfsON3SIw%26cry%3D1%26dbm_d%3DAKAmf-CadYplFh6JhdmkxUHQLlIhg_dFtxFv1UIyHZwspV3NgRYhCtFmCCaPq51HREj6RNx7KRoRXgxPww1S9A6ax8lLg-Upv-3nbyJfBmEFahRULT-DSzVqFg9uueVh1RO89NHvyVYHZI9Zk9W0HSshk79Sr_USOwp0KaU6Z9sDDfFWgwpp2PJkpUFSGjkYaFa-UjVLmacQbnKMuMr98JaDVvrANAGVvYZ4Gw866ctdSeajqQxLaPfXDcw20TJpTDV9pqcz_XrGweGc--GqdFwrxwNXQkKp1S4UZvuma3q8V-_-hGMgmZO8IibXFDlChJTfTObsQFgS_V3j-Y4zZafqSR0KTt7PCRSs-ykl2mbgP2nD-k2J28ZUhMX6jNpohdmjjmMVDhR_mMHeILIlkHt-gXsPeZMO3_qf5JgqtKRnZY769SdFcvv9C8eEOSrrv-_U7b6F8--kPB-iW2aySnHTK88_CMNZKZgj7m18eot5hFWF2gKfSjl-Gz0sqkrex73JTe4MKtAPvIcN9xAMng14ypt98ZItRO0HGgpji4XfelTasmcB1MdyXoTtBp2zCaMuu2i4PcuZ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.foxpush.com%2F&ancestorOrigins=https%3A%2F%2Fwww.foxpush.com%2Chttps%3A%2F%2Fblogtuan.info&random=2927395896062&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Mon, 29 Nov 2021 11:26:17 +0100

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 80FE 35 KB
13 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16693
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 610B 143 B
163 B 47ms
46ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=2449947586&adf=2847098451&pi=t.aa~a.2964927557~rp.2&w=383&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=383x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1541&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280&nras=5&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=3699&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wSxp47vDvn&p=https%3A//blogtuan.info&dtd=74

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 29 Nov 2021 10:58:25 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1672
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9EC4 1 KB
749 B 45ms
45ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 13:26:12 GMT
expires: Mon, 29 Nov 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 79205
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1444 624 B
297 B 52ms
52ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COLKyrsCEM2AjLwCGOC1vLcBMAE&v=APEucNXe0PayAg46Xtz3r1JqH3-aokmHtJzw8HFDPO62jXVN5yQceLl_5dcthmMnzMjHCamMIIpvNaeUax29YfanVh7vxND2-XEhhZ1o8aj-G8UilS3HG3Nhmcp3CF2Rt__MNT9c2RFPVpHUz6ZVVdvxDOktagAYuMdQ3bpvG1Eb2Qdi5zP3e3g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3149249042&adf=2279666065&pi=t.aa~a.2964750914~rp.2&w=379&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=379x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280&nras=3&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=2790&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tpYqTUWWo1&p=https%3A//blogtuan.info&dtd=68

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3149249042&adf=2279666065&pi=t.aa~a.2964750914~rp.2&w=379&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=379x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280&nras=3&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=2790&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tpYqTUWWo1&p=https%3A//blogtuan.info&dtd=68

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 29 Nov 2021 11:26:17 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 21DA 13 KB
9 KB 79ms
78ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AbtvtLLv6sk1wG08yeZ27yZNUb1yCrUCChWLfRIoZ0mnbKhaI69pNpfCiB3jmODIuACAupqMl0I0SS83dVLqV_GQlyyloVZku1V0yjVutQEv8wMIP8K4kQfvlfU_5_46pbbuMqh73Mb2zoXjW7YvCgPdJL4A&dbm_d=AKAmf-DF9TpWLn9qF1VlK0eaNX_ni64G-N2pWZQ5Xpr4GaBk0g57-SmzukRfU-AtJg5AS1NfFDNHR3JVPRQhJ0k9IUqURUWmndcFNoTBEz27FXesjtb-X1CFGT9G4-RZHQDBjS-DsAVEjUKzVcRMXmto4tq7L0syz62IjBntDBoQwHupcqGY1x_LA0XqYl_F-pdLRPQh5b2Sag8x1Jm83df7iOwcruzDKJTjpF3D9QeKOCR3al7--PUQtDFgKTFuccV0uynL3QMt5zmLwfCdRrVJ_V7Y_A1ZCPcTBc-GReYZiCjjbyOWJ7fIkyNyUEQKOC2_yLOsAdANd62kZ3pik1RIa554yVWFrmMhPcrnw9eQY7CTlkao-tXoHm0WOQAs2Scf0y_IcFED4wjNl65CzkBHznfokhzApZSe43UA_Zujh3Vbi7mn6lQUaoX87i5gECo8UabsMaQEHfIEA0h6i91YrRClGuhuvUejdLEPTwDTXazDzBrJRIlqMKLxWam8Zt4dA2aafFGjP5ZbmY8wwxSJlhircjiHkTLTXyXG11ayo0HdKy5W3DBQFcN5MRa35vV1xdqbg2htQnLRvA-B7GCiTwlPktAWBtl-G2gphMmGEuO-ihHX5T_Zcaz7rEBXZMbFRseipcVBLn7EhmIXKQaqxTc33bb8vva4fckr0oz_BaVRsDBL2nVtk1LSBWhQ4DW_O409up7syWsSsQxDJEMKw6Izl3fJIGSQgtIe0527dXQmO2LlS8QY-TDFdXWYHUU7gpOgcRFL82xuddeWHIdKg1Pz57eNV9YoxekA8ZU8HbFrRjCw9di2DnwuAK62NEN5jVXo_qSrYJyXXVKOmJIvskwSn_Z01LF4yJWk7dP1Z6ssl154FEBuKBrEO6o2KuVj40UjYHRyOz09bKejx94Jz9FtkWZsisaDbk756inHDAqq0ZEP1_uGtFQcPxZC8E-2UWCAanUpFt8dqH31wfRi1u7TTT8dWkbEmTbjNZKaUxS1_GUIKb8dI6iecXHzXvOAhSBdCZuP3D7jwnliVV-HkUi24djOFsecB4unvd1UvxDDrgHxFd500hs-kT-u5E8FPPy0zmJN10BMYHjiq0qfiG9lw48gXBT_GBBnAMK9iHfef3MF6bvud77geG-aM75rbeBgq1N6b1mh0vfU_2jFiJezOxspV-ZREM90RGpN2QtV7oB3h4dFswAr4p2luGaTcwRkCRIWoivuEykb3GoQfboK1z1vxLdu6OoKMDLaTjg-BCuWXkv3xIoblxGHdwXJOntYkNXZdGD6vDLOzuwxeSNGWvd_lJg_IGy35gWyrfAxhJSFN7TyXoCiZionoOxXVuibTwFAGElRBMtumVaO5m92RUP5pFbziXYtZ2SsA6gtPQB2k05MQY9Kiubmr30E1e6f06W_bmn4soL_oWJVUKfVUBTnciqdcNyfPs0m5GRM_SyVAJHRP5prAFbTrJkdzk_-KJXoGN3jlg_fhkT8iivYfUFMSQNF-D3fm6yY98bbwuKwZt3qfkAXRyjSkAyp7oPzJlpJ6YklVLuJ73cW6GsAQZEVvNeWSmxxajAe1pfFjW_G3ikS7nd4IcLauhwchmNTS_YGml3LqaVvKihTDGa-lCYkL50TyJNWbyhdVvKK_0-Ppw-Vy1d3OPJsdBb0a0ecfMT_ygQfQyvFjQCgdDIY0dth2XqFupJUbc8EBmlxyJhk08egaVkOyyitdsbKlTaMLQeBHy4EfULhNdBShOF2GTxEuvvuHE9Fy6GfeGh5tk_X4X8UnJ0SSQe405odHbt7YYU2XoWzE5kvmT46PlMggbjEQQ6ADrxoMeZ2VLiNcs-PzZQsixxXmHsPJ21MPTsjuaQLhIDDS1M1xy8EMhLKvjfKQHBiO6Ql-PD-sqR50wqClAmfe8Ynt4sK893id-nlfdeVkZRmUCD5cbFu6hxFJFzEeMV4iHFMO0hvR-zwZoJtevRVvlx_lqCfm20Iau8Kr0O0B9MyXSvzjkUrYgaKDslNs72kwAqon_jJcLK5bR2Yi2iE7OYoqOMNXHNF-HPamqJ3wFH79mvxFUzisjubHIm8RktJfij-qNJ3U9_rlR6TAOih4T8ermsBd6WEhTOqIxXpBWyyurPRZ50rCbW0-Mga5kuTYFJRvNsf-_kLYt6o6pMSt57Fu2t08U5p9UQ4hXXXI2OgnMLDlfuloFYeKZTq2q2L562om0Ro6aRjCMCZbwyg3q--W5KOU8ExFAJY8UofYBLuMMjEEp5AzKDu1mlVpMY1Dv8-YZf1_6a-BiaEXP6IN6jRoVHyPnJFp1n-ocTHm6NgqM9Dv4E4LsVZ-j11teS7s2BMDvOnAbbInij9WMF44YqM68OU-K_eS3_9vAkTWNLnKcXpE_Uidkz2cZuAnTyox6_tteTHr74r4FVZDiDwYOQqSFy_W_LS4QFv6RHMs2lq6njisxKWy1Pe7AexqV-kWzWjAs0QWTVElDXmNplG_tVXzp8jYIn3O6TqNj_zZCrO0v-BNgQahrb3RHhP_CL2q9c85s51n2tWPflQI6e_YZZEub_tA9ysuzkJttquR6O4qxQJugAHxv7kKCsc3ZW7Oq4bYkFeV7T0tkFei6nS1T0c7Mw_Meq1d7jK78XYGWA9c8-PjsMeUxMTRkMR4A&cid=CAASEuRor7TAMyTnZFpNoGwf5w4wbA&rfl=2%2Chttps%253A%252F%252Fblogtuan.info%252F%240

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

19f05981661c80d76e702cd3bfd3f1ddf9912e72af883a5dfcc2cd8bf93da472

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3149249042&adf=2279666065&pi=t.aa~a.2964750914~rp.2&w=379&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=379x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280&nras=3&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=2790&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tpYqTUWWo1&p=https%3A//blogtuan.info&dtd=68
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9526
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame 21DA 2 KB
1 KB 58ms
8ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=10849334&cmp=26506175&plc=316870879&sid=2787705&dvregion=0&unit=300x250
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3149249042&adf=2279666065&pi=t.aa~a.2964750914~rp.2&w=379&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=379x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280&nras=3&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=2790&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tpYqTUWWo1&p=https%3A//blogtuan.info&dtd=68
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 44216edbcf372158d065f2c7062712c9c829648c355066e7cd14242843005d81

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:17 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Nov 2021 13:07:12 GMT
Server: Microsoft-IIS/10.0
ETag: "e066f48b4dbd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Timing-Allow-Origin: *
Content-Length: 1168

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 21DA 2 KB
1 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 897
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:11:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 21DA 119 KB
36 KB 68ms
67ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 21DA 15 KB
6 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 309
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 21DA 42 B
63 B 71ms
71ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A2potvv2C9ZHu8shN3Fx0BA0T0p0g9s3VcDW7JjBFozgu5fjeOpIHyiV4dYx8iUdbCvOwS3NlvyLpFbjJ5eE2j-EX-KjO5Spa9Qj6ScpGKzAcTStM

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 5068 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 52b2e3a41743a808941d706aacdaac23da30ba847f4ab0c7d8964c57611524c0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3C43
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIsybcQR9geYF0KAap2ddR4&google_cver=1

43 B
894 B

44ms
43ms

Image
image/gif

184.51.9.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIsybcQR9geYF0KAap2ddR4&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiQ5uioATAB&v=APEucNWT9Q4OSFf91_7LE_LcqLNytlET-r3moTOnficDk59187UvbLkNvtXACYf0zBuCmdLnve67gK4IUqYDpoBeL9Oq-QlzFmELqp1Sf3m4ikulPZOOAd2gdMaGycRBh7pomLWaag4vTuptQ9WRCBZkicLH8wZv1EuRRGIwyFY1CGUtAHa5BtU
Protocol: HTTP/1.1
Server: 184.51.9.98 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 29 Nov 2021 11:26:18 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIsybcQR9geYF0KAap2ddR4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3C43
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YaS42enVbr8Gi.MWeoCQnwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIsybcQR9geYF0KAap2ddR4&google_cver=1&google_hm=2

43 B
894 B

71ms
71ms

Image
image/gif

184.51.9.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIsybcQR9geYF0KAap2ddR4&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiQ5uioATAB&v=APEucNWT9Q4OSFf91_7LE_LcqLNytlET-r3moTOnficDk59187UvbLkNvtXACYf0zBuCmdLnve67gK4IUqYDpoBeL9Oq-QlzFmELqp1Sf3m4ikulPZOOAd2gdMaGycRBh7pomLWaag4vTuptQ9WRCBZkicLH8wZv1EuRRGIwyFY1CGUtAHa5BtU
Protocol: HTTP/1.1
Server: 184.51.9.98 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 29 Nov 2021 11:26:18 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIsybcQR9geYF0KAap2ddR4&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3C43
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEOTAizjYqqZsCKepaMnkY5s&google_cver=1

43 B
1008 B

7ms
7ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEOTAizjYqqZsCKepaMnkY5s&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiQ5uioATAB&v=APEucNWT9Q4OSFf91_7LE_LcqLNytlET-r3moTOnficDk59187UvbLkNvtXACYf0zBuCmdLnve67gK4IUqYDpoBeL9Oq-QlzFmELqp1Sf3m4ikulPZOOAd2gdMaGycRBh7pomLWaag4vTuptQ9WRCBZkicLH8wZv1EuRRGIwyFY1CGUtAHa5BtU

Protocol

HTTP/1.1

Server

37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 9866b427-7263-4424-8ab7-25430d7b0e7b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEOTAizjYqqZsCKepaMnkY5s&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3C43
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D

170 B
188 B

66ms
66ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 562ba78f-0df9-48b0-92f5-e6ce8bea2bd5
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 37B4 169 KB
59 KB 174ms
39ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 08:41:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9873
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 30 Nov 2021 08:41:45 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 37B4 8 KB
3 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BHpGHKb-aLQegux8TETvEgjiMkJ2exyGxiXax-n7tvenGGB5GnC9xx6uGoszpHUycBV1MEBrwX23F4EQU9KzSQFlZ53wcXB3DEQo_lVZTg4FZOh5jBc4P7MntOGCJvUwh1kLmbjz8eBA26ayOqChdLGOlMeA&dbm_d=AKAmf-BtdH049dTyHWzwL7qRn_CiR6-0pn8ia0dxCgVk4hJ78cqtMzqp6ax0ysdmeErPSeQ-EgJ5hO57qNEreEU5q_iC-OvKcwE1idb-zqW3T0U7xDoO5jpxjHJKhoD_PIT224_qMY2cleSE6MinMMicqHgqjtgeFSyyFC9QjAEauuIy7ReDJJX3jxWzmhv66lWmfvmlS6U9lhTS5i8SZNU5YIgf_eRzaX6aaCcNTpe7qhZ1RM0L_yoi2N--ISGOnOH4p-Bn4_u5JCC9U1pI21Td55d6wSKwA7gogwaNL8GDf4fk3ZO_dBILf1LmYbwSmW_42Sk0A_LoG_zcNOT4hC-EdiMI7aJp7Q1DlZfo1Thk2Rl0IC6neHbHgNMgB_ZTUXLsunF29i3V6tNMn0KIeQb2BpHFe8pgpMRJ0qs2P-cugK9rH4VpYhd0PhbQC7kfkE7Kdsp0QZT0KujV0RhulsvdxncbvD0jvDIFNzhXYauTVtfaCApDhLyCLdBy4QHKWD01eKXE6vvNlvOBVtvCoP8zu3by_8LMkfWSI6kVUDKXRliwrWZYxu5nYjwc315YfrjCTFsVhTOD4_Zkbp8x9dU37XMPXAhwYxE-ZoeQVSBpEChFpKXEWoUJ_jSVS220rJmwtIteSV3ZmNcsUf9TFwy6miln-3PArramBYYcTngSjSvevmzjderpjFVGONk8C4yhMIzJYyV7VB8k20IlkytOt3gih-ZAFSttDDBIPPtl2l6Ff2v207_mBNkaHJFsXkiV-sRiz-ZRbnC9aAP0zGT-xjKzrIDOkXHmgoKUG--4njtMBtf5eWAGLbFUsi4JgwYYgvuj2PI8TaukLd_Feb_Xbs0ASjvfvAKknJ3vd0dFJUqOU0duZPnA3upuH26lhcXQcDX47elx5ymSL3oy6wRyxYNqRFaDoW8kwbIoCj6j1aK_gjb6LvGyAF7vb17AiSgVoUdkIS4HfsoMvXSL19s1H6uGp2rjLTynfHNvrqoP9ByPwW5d8VZWgPgl2fsm7wTlHR_MQ87Q8ET5kEleSPNOe-2DY2l-MlAbYKq6rNkIaLwSlFhxKiaVIKhG-8E7xLeHgY5OuYLoBV8Arh8SijgB74CjOe14dlpDnrlIWAHjlEgCoswK5Z2va4IkjiDD3fr2bn6AmcfTlYXv52Du-lZMDN5GPdCr7A8JeikGQPHyqliLAShainpeikKb6XEHkzxbiwtFpcR-RhiJDUD8970HN1Q__jHoL2heEbs5YBkK_t4IfAVI6IEuqHMeuZl3LmZA4v506LwHHqbr7MUWu-WNCJZgBCKX6Pv2Jo__HwsMbT_U2T2SQL1SV52F3RGXm2pJV4JoIcAKcpgz9NVdDph7Cc4EoAWqTL0GzHSrE2o67XlFJs_ufr69GsiGFMdCK55HnosAVEX2y-TuUov1lp8Vt3KR-HpibBxUU9Dk7HVDPuTKHprKBnOFhD8zXmhQfKtGFssi-k7jd_e36Ki4-mOsEaXLHHATn4P8t9Nu_ccQaML6E3ppro2A9XKMr2EzhgKyIGAWT2AIUFtezR_HU28KPbyYbZsxjhjA9YlxWYXsPycb_ivjLNjsNpUiPmNzVqhwrl-fIQZU9erTG1P-H7aJDjONS9gDqDCA_DrOteRaqyb99ZlkXKgZiwPCOtIv-SRrVQQVjbpvotD1BFk9hlwE5cOghlkCEyq4PEjShXzH3qNr8rEcVGWMhjnuXwgcG5yApQlzsLIwxkoAo5nfC6ERfNZffBhmBAjTJf_OADnN85L9FbZq1DOzhQmlwMg0eqL9Ad1atU1SmrdwDDKw1noqzX-uDboOqjtnToBUfWHlWAFSW3hrf7XZlM-3j2MXzbrHcXQvJ84VIIr7uPJgkHpBJMZMGP0WR0J5soqHWL_9wEQ48IrFRQLGDw-NBPsIis8XX1jhMnwTdWoFApQJTNuWJqxdrFa5uAzogF7Avjfbu1SVufQzDvbFAGThZQ7XbOi4EAFSUOcXz7rNkYChjCKyMhFeUkspjsa4K4bAsDfIeQNMNCACrssBAvg8EFFtOyPPDvnf_FPOJ_KNgDXMbkbElLDr8TD0-f0DsHuH3ISbvuMSvLMLn7HubiMLylz38XTkLTsE3rZaqvuuaJ82sTYvYIGn_VzsTbp0UPvuZLKahbyy2ZUiW8AAJR_k41f_6DSeqCxXYZpOECKoU9yXRKvgeWWX9zapuN97SaxnK94Yz2UaOYjdF8hOdTu6V2addhDPr-SDZRCPblA2BLOFdJO6TwV6mZwc-7PEtifMx8bRmrM35CTN204dOn5Wskz3xxEu4stbNCTtf8zEw9ypcj_LlDAcX9Fgv4ip5reusUe2f5NsMRBMPjTUVJ8ntO11R31Kg0tPQ3vOJDkaxdp953wMry3CVWRMFnN_jygjGn7aPQfWzxh-D9JlhGoTHPBDYya-BUalFd-QYyEHvVzi1ymooKzUiJhT8HO-NRPfYQYfcOLNFx10ow8CFHIS7inNaO3fDsH65jn_fp0SOTU-okSWCNbZrWaH-GHa60kkG6cG2QXxHzz7UjIB6V4C3A1KJWX8gceQMBQ17vPWQipZZhEE_6mvy7x00BCJJHWDh3DNhuX6gT9Fy0493DXj9Y-lBJnC7elU_AeRvXtvMaS2xCHHki792Hr6wpsD7TY4ARryq_-lpmSbuuuP_ShPvpkeQvDvznyt729H0N12huLfq249vlMYyDpMtbO5ekps7tXIfKz-iA2M5KmXEzN-UTsuFERv7o-4xGeTvPVXdUr-B-C12gq4BA1GKCds8qkZI0JmlV1Oohq0werKVr3vFFsup_OotduOP10YaVIFABLRBLvwGA64VXkgcKh5ojBRNJzi724TSlE4w7HZOmwY9uLsnG8TOGVxyyv4nw0cD-o5P-MsZlD0XAO64a7f3XmRL08CHn7nKWwT4Gf62_gRhxlADCMEyAw1QPcG-OmmZXYYMi0i_t4fnzdWFRIpD6jyLbN4HWPoV77XBU2iIal36l5lat7BApLbmC3S&cid=CAASEuRoTkugs-ourpjmwJhpTEc-0Q&rfl=2%2Chttps%253A%252F%252Fblogtuan.info%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:23:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 141
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:23:57 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 37B4 24 KB
9 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:24:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 101
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9475
x-xss-protection: 0
server: cafe
etag: 15988442915344899701
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:24:37 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 21DA 41 KB
15 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AbtvtLLv6sk1wG08yeZ27yZNUb1yCrUCChWLfRIoZ0mnbKhaI69pNpfCiB3jmODIuACAupqMl0I0SS83dVLqV_GQlyyloVZku1V0yjVutQEv8wMIP8K4kQfvlfU_5_46pbbuMqh73Mb2zoXjW7YvCgPdJL4A&dbm_d=AKAmf-DF9TpWLn9qF1VlK0eaNX_ni64G-N2pWZQ5Xpr4GaBk0g57-SmzukRfU-AtJg5AS1NfFDNHR3JVPRQhJ0k9IUqURUWmndcFNoTBEz27FXesjtb-X1CFGT9G4-RZHQDBjS-DsAVEjUKzVcRMXmto4tq7L0syz62IjBntDBoQwHupcqGY1x_LA0XqYl_F-pdLRPQh5b2Sag8x1Jm83df7iOwcruzDKJTjpF3D9QeKOCR3al7--PUQtDFgKTFuccV0uynL3QMt5zmLwfCdRrVJ_V7Y_A1ZCPcTBc-GReYZiCjjbyOWJ7fIkyNyUEQKOC2_yLOsAdANd62kZ3pik1RIa554yVWFrmMhPcrnw9eQY7CTlkao-tXoHm0WOQAs2Scf0y_IcFED4wjNl65CzkBHznfokhzApZSe43UA_Zujh3Vbi7mn6lQUaoX87i5gECo8UabsMaQEHfIEA0h6i91YrRClGuhuvUejdLEPTwDTXazDzBrJRIlqMKLxWam8Zt4dA2aafFGjP5ZbmY8wwxSJlhircjiHkTLTXyXG11ayo0HdKy5W3DBQFcN5MRa35vV1xdqbg2htQnLRvA-B7GCiTwlPktAWBtl-G2gphMmGEuO-ihHX5T_Zcaz7rEBXZMbFRseipcVBLn7EhmIXKQaqxTc33bb8vva4fckr0oz_BaVRsDBL2nVtk1LSBWhQ4DW_O409up7syWsSsQxDJEMKw6Izl3fJIGSQgtIe0527dXQmO2LlS8QY-TDFdXWYHUU7gpOgcRFL82xuddeWHIdKg1Pz57eNV9YoxekA8ZU8HbFrRjCw9di2DnwuAK62NEN5jVXo_qSrYJyXXVKOmJIvskwSn_Z01LF4yJWk7dP1Z6ssl154FEBuKBrEO6o2KuVj40UjYHRyOz09bKejx94Jz9FtkWZsisaDbk756inHDAqq0ZEP1_uGtFQcPxZC8E-2UWCAanUpFt8dqH31wfRi1u7TTT8dWkbEmTbjNZKaUxS1_GUIKb8dI6iecXHzXvOAhSBdCZuP3D7jwnliVV-HkUi24djOFsecB4unvd1UvxDDrgHxFd500hs-kT-u5E8FPPy0zmJN10BMYHjiq0qfiG9lw48gXBT_GBBnAMK9iHfef3MF6bvud77geG-aM75rbeBgq1N6b1mh0vfU_2jFiJezOxspV-ZREM90RGpN2QtV7oB3h4dFswAr4p2luGaTcwRkCRIWoivuEykb3GoQfboK1z1vxLdu6OoKMDLaTjg-BCuWXkv3xIoblxGHdwXJOntYkNXZdGD6vDLOzuwxeSNGWvd_lJg_IGy35gWyrfAxhJSFN7TyXoCiZionoOxXVuibTwFAGElRBMtumVaO5m92RUP5pFbziXYtZ2SsA6gtPQB2k05MQY9Kiubmr30E1e6f06W_bmn4soL_oWJVUKfVUBTnciqdcNyfPs0m5GRM_SyVAJHRP5prAFbTrJkdzk_-KJXoGN3jlg_fhkT8iivYfUFMSQNF-D3fm6yY98bbwuKwZt3qfkAXRyjSkAyp7oPzJlpJ6YklVLuJ73cW6GsAQZEVvNeWSmxxajAe1pfFjW_G3ikS7nd4IcLauhwchmNTS_YGml3LqaVvKihTDGa-lCYkL50TyJNWbyhdVvKK_0-Ppw-Vy1d3OPJsdBb0a0ecfMT_ygQfQyvFjQCgdDIY0dth2XqFupJUbc8EBmlxyJhk08egaVkOyyitdsbKlTaMLQeBHy4EfULhNdBShOF2GTxEuvvuHE9Fy6GfeGh5tk_X4X8UnJ0SSQe405odHbt7YYU2XoWzE5kvmT46PlMggbjEQQ6ADrxoMeZ2VLiNcs-PzZQsixxXmHsPJ21MPTsjuaQLhIDDS1M1xy8EMhLKvjfKQHBiO6Ql-PD-sqR50wqClAmfe8Ynt4sK893id-nlfdeVkZRmUCD5cbFu6hxFJFzEeMV4iHFMO0hvR-zwZoJtevRVvlx_lqCfm20Iau8Kr0O0B9MyXSvzjkUrYgaKDslNs72kwAqon_jJcLK5bR2Yi2iE7OYoqOMNXHNF-HPamqJ3wFH79mvxFUzisjubHIm8RktJfij-qNJ3U9_rlR6TAOih4T8ermsBd6WEhTOqIxXpBWyyurPRZ50rCbW0-Mga5kuTYFJRvNsf-_kLYt6o6pMSt57Fu2t08U5p9UQ4hXXXI2OgnMLDlfuloFYeKZTq2q2L562om0Ro6aRjCMCZbwyg3q--W5KOU8ExFAJY8UofYBLuMMjEEp5AzKDu1mlVpMY1Dv8-YZf1_6a-BiaEXP6IN6jRoVHyPnJFp1n-ocTHm6NgqM9Dv4E4LsVZ-j11teS7s2BMDvOnAbbInij9WMF44YqM68OU-K_eS3_9vAkTWNLnKcXpE_Uidkz2cZuAnTyox6_tteTHr74r4FVZDiDwYOQqSFy_W_LS4QFv6RHMs2lq6njisxKWy1Pe7AexqV-kWzWjAs0QWTVElDXmNplG_tVXzp8jYIn3O6TqNj_zZCrO0v-BNgQahrb3RHhP_CL2q9c85s51n2tWPflQI6e_YZZEub_tA9ysuzkJttquR6O4qxQJugAHxv7kKCsc3ZW7Oq4bYkFeV7T0tkFei6nS1T0c7Mw_Meq1d7jK78XYGWA9c8-PjsMeUxMTRkMR4A&cid=CAASEuRor7TAMyTnZFpNoGwf5w4wbA&rfl=2%2Chttps%253A%252F%252Fblogtuan.info%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 12:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 427062
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 24 Nov 2022 12:48:36 GMT

GET
H/1.1 200
OK dvbs_src_internal100.js Show response
cdn.doubleverify.com/ Frame 21DA 56 KB
18 KB 8ms
8ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal100.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=10849334&cmp=26506175&plc=316870879&sid=2787705&dvregion=0&unit=300x250
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 49a070133915e05e9b7723d25d8f07b12dda78f7d89c5334176329b5dc8019a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Content-Encoding: gzip
Last-Modified: Wed, 17 Nov 2021 13:07:26 GMT
Server: Microsoft-IIS/10.0
ETag: "0fb3411b4dbd71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 18242

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame AD5F 35 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16694
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0B97 624 B
297 B 55ms
49ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhi3vqi7ATAB&v=APEucNWsSQiquCjAw1tTQiFO7YhDQQ8YgKcSw0mAzJzPnT4YsU9Hgj54ZtAbbcATOpl5Zl6cwOjVu84ebJ7eFOpyfJWO-AiSXA_Ew9_Jh8bBDgPqSEoQYYktrL_UyYWeU8LYeg140vPO6e5oQRQUPb7ln279U7PKisDKJhUV1F9e7_Vugo6uR_c

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Mon, 29 Nov 2021 11:26:18 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 7465 106 KB
37 KB 113ms
94ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 08:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11551
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 30 Nov 2021 08:13:47 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 7465 6 KB
3 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp_fy2019.js

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d0744b54be7eab148245653f8fad2e4a0e8875b886bcacbb2c70741872eda55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 09:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5909
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2626
x-xss-protection: 0
server: cafe
etag: 8548655983161038638
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 09:47:49 GMT

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 7465 19 KB
8 KB 42ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 10:27:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3526
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 10:27:32 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 7465 2 KB
1 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 898
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:11:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7465 119 KB
36 KB 69ms
67ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:18 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 7465 15 KB
6 KB 41ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 310
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 7465 0
0 49ms
47ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRqvLxLYJBsrOYIzFmPtnL0y9sCRQNTpUkQH2Z-UTVdRQKfbDmlkCjCE8QrC0y9KNeCR13_JecxtdW0Jp4f3Jj3QGXImA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7465 42 B
63 B 73ms
71ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DqhNblc0LVjTt5wgGNcft28Potk7DbSbr3w0mvJyHnjG5AzZuQl6T0IgQx75dxUAvdpAqMKE2D4KX0fnssgd9sqtGO847OnBH0gVXej8sPRRmxpLs

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame F08D
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=94786400065214000757623011793002&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=94786400065214000757623011793002&actionid=731824&produktid=businessgiro&dt_url=

0
629 B

230ms
185ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=94786400065214000757623011793002&actionid=731824&produktid=businessgiro&dt_url=

Requested by

Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=6jrsnqs01vv6&nw=20&renderingType=javascript&namespace=6e83604827&subid=&uid=ec3bdb5935ba25c2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfH-e2bikYdHGA9uNrASgu6_YBd2t6KhgpbnU3JAK8C4QASCz8shxYJXikIKgB8gBCakC0UutODjlsj6oAwGqBOoBT9DTjlJd6p9-NV05_pHScbY8q3BaTPEcW_D8i_xy5UYbiX4C06JzC-dtmgp0DuMZX4YtYzLtPvQJJBFlTiayNU2-OAzbhQQpOWXxZ67blHvHt-K9yC2NIHdg5uI5U3aqvHBE8YV2ZnXso0dyk6VGW5ILWW28-g0sSu_MNs2J9IwSUgkgUVY_eSji6kTXsRo6vNowpxd56sAs5Yzilu3mirZz_tYCbB_hnH5_epwpWmKJAkEHkC3RREgtQ7mX1StZG0YVX_wlvS2VMSWgwsodUJPV8VXDDy3r7woLdh9WdhheaLG4w09uNRZkwATOjruxlgLgBAOQBgGgBk2AB-vn6F6oB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE57l7AzQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRod_F1ewIynux5YygVmGPvOA%26sig%3DAOD64_0uKl7BkvV71WKax0tzyCt_41Yo1g%26client%3Dca-pub-8113799588685394%26dbm_c%3DAKAmf-A4n2F1GSGwyIoQNpdGTcEHC6z2ztiLcn5EajJilc6PMo6PP_HUj-QhMnxi16JQIcP6luPWDqukLagvfwlww54LWiR5y3Q3J3zqKobL3SE4l6VumEPZfPxEqYJv1aGbi0G3gig-gJ7skMZBWstGzPfsON3SIw%26cry%3D1%26dbm_d%3DAKAmf-CadYplFh6JhdmkxUHQLlIhg_dFtxFv1UIyHZwspV3NgRYhCtFmCCaPq51HREj6RNx7KRoRXgxPww1S9A6ax8lLg-Upv-3nbyJfBmEFahRULT-DSzVqFg9uueVh1RO89NHvyVYHZI9Zk9W0HSshk79Sr_USOwp0KaU6Z9sDDfFWgwpp2PJkpUFSGjkYaFa-UjVLmacQbnKMuMr98JaDVvrANAGVvYZ4Gw866ctdSeajqQxLaPfXDcw20TJpTDV9pqcz_XrGweGc--GqdFwrxwNXQkKp1S4UZvuma3q8V-_-hGMgmZO8IibXFDlChJTfTObsQFgS_V3j-Y4zZafqSR0KTt7PCRSs-ykl2mbgP2nD-k2J28ZUhMX6jNpohdmjjmMVDhR_mMHeILIlkHt-gXsPeZMO3_qf5JgqtKRnZY769SdFcvv9C8eEOSrrv-_U7b6F8--kPB-iW2aySnHTK88_CMNZKZgj7m18eot5hFWF2gKfSjl-Gz0sqkrex73JTe4MKtAPvIcN9xAMng14ypt98ZItRO0HGgpji4XfelTasmcB1MdyXoTtBp2zCaMuu2i4PcuZ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.foxpush.com%2F&ancestorOrigins=https%3A%2F%2Fwww.foxpush.com%2Chttps%3A%2F%2Fblogtuan.info&random=2927395896062&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Mon, 29 Nov 2021 12:26:17 GMT
server: Microsoft-IIS/10.0
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Mon, 29 Nov 2021 11:26:17 GMT
content-length: 0

Redirect headers

Server: nginx/1.17.5
Date: Mon, 29 Nov 2021 11:26:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
X-Powered-By: PHP/7.2.21
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
Access-Control-Allow-Credentials: true
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=94786400065214000757623011793002&actionid=731824&produktid=businessgiro&dt_url=
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload max-age=15768000
X-IPLB-Request-ID: B9D59BA2:D706_91EFC182:01BB_61A4B8DA_F10F185:2A265
X-IPLB-Instance: 40028
Cache-control: private

GET
H2

200

index2.html Show response
singles.parship.de/lp/v00/6/U/htlp/ Frame FDA4
Redirect Chain

https://www.awin1.com/cshow.php?s=2661283&v=11524&q=391598&r=296283&pref1=94786400065214000757623011793002&pv=1
https://trf.greatviews.de/cl?m315=c&q=nyVlHJ2acuRY7q9fsD728kyQ
https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID

914 B
1 KB

80ms
36ms

Document
text/html

2606:4700::6813:ba79
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:ba79 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

564bfea9e4f4cb22d736c34b4765aa988023adc548dfcd4df5a9e211d7c12ef0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-type: text/html
last-modified: Mon, 29 Nov 2021 05:01:27 GMT
vary: Accept-Encoding,User-Agent
p3p: CP="ALL CUR OUR STP UNI PUR"
referrer-policy: no-referrer-when-downgrade
strict-transport-security: max-age=15552000
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-content-type-options: nosniff
server: cloudflare
cf-ray: 6b5b7af49a361f2d-FRA
content-encoding: br

Redirect headers

server: nginx
date: Mon, 29 Nov 2021 11:26:18 GMT
content-type: text/html; charset=UTF-8
location: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID
p3p: policyref="/w3c/p3p.xml", CP="DSP COR NID OUR IND COM NAV INT"
server-id: 12
x-robots-tag: noindex, nofollow
access-control-allow-origin: *

GET
H2 200 script.js Show response
img.metaffiliation.com/na/na/res/trk/ Frame 462C 128 KB
33 KB 79ms
13ms Script
application/javascript 192.229.220.129
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://img.metaffiliation.com/na/na/res/trk/script.js
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=6jrsnqs01vv6&nw=20&renderingType=javascript&namespace=6e83604827&subid=&uid=ec3bdb5935ba25c2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfH-e2bikYdHGA9uNrASgu6_YBd2t6KhgpbnU3JAK8C4QASCz8shxYJXikIKgB8gBCakC0UutODjlsj6oAwGqBOoBT9DTjlJd6p9-NV05_pHScbY8q3BaTPEcW_D8i_xy5UYbiX4C06JzC-dtmgp0DuMZX4YtYzLtPvQJJBFlTiayNU2-OAzbhQQpOWXxZ67blHvHt-K9yC2NIHdg5uI5U3aqvHBE8YV2ZnXso0dyk6VGW5ILWW28-g0sSu_MNs2J9IwSUgkgUVY_eSji6kTXsRo6vNowpxd56sAs5Yzilu3mirZz_tYCbB_hnH5_epwpWmKJAkEHkC3RREgtQ7mX1StZG0YVX_wlvS2VMSWgwsodUJPV8VXDDy3r7woLdh9WdhheaLG4w09uNRZkwATOjruxlgLgBAOQBgGgBk2AB-vn6F6oB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE57l7AzQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRod_F1ewIynux5YygVmGPvOA%26sig%3DAOD64_0uKl7BkvV71WKax0tzyCt_41Yo1g%26client%3Dca-pub-8113799588685394%26dbm_c%3DAKAmf-A4n2F1GSGwyIoQNpdGTcEHC6z2ztiLcn5EajJilc6PMo6PP_HUj-QhMnxi16JQIcP6luPWDqukLagvfwlww54LWiR5y3Q3J3zqKobL3SE4l6VumEPZfPxEqYJv1aGbi0G3gig-gJ7skMZBWstGzPfsON3SIw%26cry%3D1%26dbm_d%3DAKAmf-CadYplFh6JhdmkxUHQLlIhg_dFtxFv1UIyHZwspV3NgRYhCtFmCCaPq51HREj6RNx7KRoRXgxPww1S9A6ax8lLg-Upv-3nbyJfBmEFahRULT-DSzVqFg9uueVh1RO89NHvyVYHZI9Zk9W0HSshk79Sr_USOwp0KaU6Z9sDDfFWgwpp2PJkpUFSGjkYaFa-UjVLmacQbnKMuMr98JaDVvrANAGVvYZ4Gw866ctdSeajqQxLaPfXDcw20TJpTDV9pqcz_XrGweGc--GqdFwrxwNXQkKp1S4UZvuma3q8V-_-hGMgmZO8IibXFDlChJTfTObsQFgS_V3j-Y4zZafqSR0KTt7PCRSs-ykl2mbgP2nD-k2J28ZUhMX6jNpohdmjjmMVDhR_mMHeILIlkHt-gXsPeZMO3_qf5JgqtKRnZY769SdFcvv9C8eEOSrrv-_U7b6F8--kPB-iW2aySnHTK88_CMNZKZgj7m18eot5hFWF2gKfSjl-Gz0sqkrex73JTe4MKtAPvIcN9xAMng14ypt98ZItRO0HGgpji4XfelTasmcB1MdyXoTtBp2zCaMuu2i4PcuZ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.foxpush.com%2F&ancestorOrigins=https%3A%2F%2Fwww.foxpush.com%2Chttps%3A%2F%2Fblogtuan.info&random=2927395896062&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.220.129 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (muc/331D) /
Resource Hash: 7c22b007743a09ec0ad5931edb3cc96fa88009586b10e0d3c502eeca52fbb183

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: gzip
last-modified: Tue, 19 Oct 2021 09:25:18 GMT
server: ECAcc (muc/331D)
age: 2592
etag: "616e8efe-201f0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=600, s-maxage=3600
accept-ranges: bytes
content-length: 33512

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 462C
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=94786400065214000757623011793002
https://ad-server.eu/wm/pb/native.png

68 B
312 B

157ms
28ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: HTTP/1.1
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:30:45 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: nginx/1.19.7
X-IPLB-Request-ID: B9D59BA2:D704_91EFC182:01BB_61A4B8DA_F0DF6DC:2A263
X-Powered-By: PHP/7.2.34
X-IPLB-Instance: 40028
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload, max-age=15768000
Content-Type: text/html; charset=UTF-8
Location: https://ad-server.eu/wm/pb/native.png
Cache-control: private
Transfer-Encoding: chunked
Keep-Alive: timeout=20

GET
H/1.1 200
OK trk.php
action.metaffiliation.com/ Frame 462C 43 B
2 KB 94ms
30ms Image
image/gif 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://action.metaffiliation.com/trk.php?taff=P511E19571C9F151&argsite=94786400065214000757623011793002&gdprconsent=
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request.php?zone=6jrsnqs01vv6&nw=20&renderingType=javascript&namespace=6e83604827&subid=&uid=ec3bdb5935ba25c2&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCfH-e2bikYdHGA9uNrASgu6_YBd2t6KhgpbnU3JAK8C4QASCz8shxYJXikIKgB8gBCakC0UutODjlsj6oAwGqBOoBT9DTjlJd6p9-NV05_pHScbY8q3BaTPEcW_D8i_xy5UYbiX4C06JzC-dtmgp0DuMZX4YtYzLtPvQJJBFlTiayNU2-OAzbhQQpOWXxZ67blHvHt-K9yC2NIHdg5uI5U3aqvHBE8YV2ZnXso0dyk6VGW5ILWW28-g0sSu_MNs2J9IwSUgkgUVY_eSji6kTXsRo6vNowpxd56sAs5Yzilu3mirZz_tYCbB_hnH5_epwpWmKJAkEHkC3RREgtQ7mX1StZG0YVX_wlvS2VMSWgwsodUJPV8VXDDy3r7woLdh9WdhheaLG4w09uNRZkwATOjruxlgLgBAOQBgGgBk2AB-vn6F6oB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIgOGAEBABGB2ACgOYCwHICwGADAGwE57l7AzQEwDYEwOIFAHYFAHQFQH4FgGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASEuRod_F1ewIynux5YygVmGPvOA%26sig%3DAOD64_0uKl7BkvV71WKax0tzyCt_41Yo1g%26client%3Dca-pub-8113799588685394%26dbm_c%3DAKAmf-A4n2F1GSGwyIoQNpdGTcEHC6z2ztiLcn5EajJilc6PMo6PP_HUj-QhMnxi16JQIcP6luPWDqukLagvfwlww54LWiR5y3Q3J3zqKobL3SE4l6VumEPZfPxEqYJv1aGbi0G3gig-gJ7skMZBWstGzPfsON3SIw%26cry%3D1%26dbm_d%3DAKAmf-CadYplFh6JhdmkxUHQLlIhg_dFtxFv1UIyHZwspV3NgRYhCtFmCCaPq51HREj6RNx7KRoRXgxPww1S9A6ax8lLg-Upv-3nbyJfBmEFahRULT-DSzVqFg9uueVh1RO89NHvyVYHZI9Zk9W0HSshk79Sr_USOwp0KaU6Z9sDDfFWgwpp2PJkpUFSGjkYaFa-UjVLmacQbnKMuMr98JaDVvrANAGVvYZ4Gw866ctdSeajqQxLaPfXDcw20TJpTDV9pqcz_XrGweGc--GqdFwrxwNXQkKp1S4UZvuma3q8V-_-hGMgmZO8IibXFDlChJTfTObsQFgS_V3j-Y4zZafqSR0KTt7PCRSs-ykl2mbgP2nD-k2J28ZUhMX6jNpohdmjjmMVDhR_mMHeILIlkHt-gXsPeZMO3_qf5JgqtKRnZY769SdFcvv9C8eEOSrrv-_U7b6F8--kPB-iW2aySnHTK88_CMNZKZgj7m18eot5hFWF2gKfSjl-Gz0sqkrex73JTe4MKtAPvIcN9xAMng14ypt98ZItRO0HGgpji4XfelTasmcB1MdyXoTtBp2zCaMuu2i4PcuZ%26adurl%3D&documentReferer=https%3A%2F%2Fwww.foxpush.com%2F&ancestorOrigins=https%3A%2F%2Fwww.foxpush.com%2Chttps%3A%2F%2Fblogtuan.info&random=2927395896062&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR CUR ADMa PSAa OUR IND NAV COM",policyref="http://www.netaffiliation.com/w3c/p3p.xml"
X-TRK-D: 0.0078918933868408
Connection: close
Pragma: no-cache
X-TRK-PROC: 73241
Last-Modified: Mon, 29 Nov 2021 11:26:18 GMT
Server: nginx
X-TRK-DECISION: 7
Content-Type: image/gif
Access-Control-Allow-Origin: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
X-TRK-SRV: 9

GET
H/1.1

200
OK

ai.aspx
m.exactag.com/ Frame 462C
Redirect Chain

https://action.metaffiliation.com/trk.php?mann=P511E19571C9F151&argsite=94786400065214000757623011793002&gdprconsent=
https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}

43 B
1 KB

68ms
18ms

Image
image/gif

85.14.248.72
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

HTTP/1.1

Server

85.14.248.72 Kamp-Lintfort, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mo, 29 Nov 2021 11:26:18 GMT
Server: Microsoft-IIS/8.5
Date: Mon, 29 Nov 2021 11:26:18 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1788
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Access-Control-Allow-Origin: *
Transfer-Encoding: chunked
X-TRK-D: 0.0042498111724854
Connection: close
Pragma: no-cache
X-TRK-PROC: 73241
Last-Modified: Mon, 29 Nov 2021 11:26:18 GMT
Server: nginx
X-TRK-DECISION: -3
Content-Type: text/html; charset=UTF-8
Location: https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
X-TRK-SRV: 9

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 462C 43 B
705 B 91ms
50ms Image
image/gif 92.123.17.141
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2601050&v=18332&q=376776&r=296283&pref1=94786400065214000757623011793002&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

92.123.17.141 Vienna, Austria, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a92-123-17-141.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A254 0
20 B 78ms
78ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021111601&jk=2383162639821943&bg=!rK-lr-vNAAZQLpa_UC47ACkAdvg8Wnd_hb3xFoRY_tYKJGjVhT5kUJ3cuq0ORlOp9yVRZnEcI8zp0AIAAACwUgAAAHloAQcKABI_AxfpH4G9KVTNZtiwbP2C6sCZApDG5_clD0ZfBQyGm2MxqS0hTlPt1k76WfYZchZn12mRAHTFXyu1xpyUb2epZ1RcoyDrV2kY2UxfH_MmVvb4GNmUs8z9IX2-j0gg5SRSErBHCe5ySTjGgxdywXu_nNfFpcjYrOUwtA3nFGjJ5CkzT3gI-aLP4aDNtY4_Agg5oVpz9cJ6H-xoPL7uuzdEhT81BZ1lDn35hBx7aESJM5yfnWd8yxLPcAS0agKw810f6nK-vZqMGiDVQAczL1fWbZRs4weF1g_XlQBjV-0sgfL_iBSbClQf0hual7dqIUfBzSDgGdapEhJLB3qFvMK4IVplG2ucDmJe1r1jyfX0v-Sk4Yu3KSOtK0v8mIeiYyFVJpPj180zHZDo7Aa2O1t75Nn71sNbX1bTexbm2EB20Il0LextEhHZSwwlwjMIz2Q3PPMdkA-fgDuS2anDJM5-ScGUZVZXbCetKfTybNx7DiEkORbqY0PdBJ2qvzdHxjP-QYMkp1Kxsw3F3_G3tPf0a9EqnrfnsyLVt9ES91blPDgfWtHaqaDQCuqZv3W0bsG9njpm5g2WdIUmbLZPruz_XEcNEVebsui06v9RugtVyCIXf9mBhMSSpxOVkz-nf_GDcGC8yAP6G2y5Mwn8i_NI8B_oFiov1dcJh11SAnGzADfw8dSYmJQaxtPazlaXttpv6gS-Fiamef7_Pv5AZtgcueP1UOcuHbpvqU3n6nqSQ-_4zs_ojULTWXNncfd9shCg0pnX20pyRMGrOhLlLJ1SKvdrivlfX0FU1awHyQlZgudfXJ7w5VjEbZvGeQeu5lmBRhWtIzl8yPVbLrGH31nYpa_ftd7JyNvY9FcMzWXZ_7m0X6q9WrarMxKuMW6oMdB5XavcFw

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.foxpush.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 9EC4 35 B
463 B 28ms
9ms Image
image/gif 2620:116:800d:21:fcb8:22d2:d390:5f1b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEN1plM66ArzaxhjEES28sAo&google_cver=1&google_push=AYg5qPJpnPl8zPZD8cuxrkch-ofhH9ClTxJWBKOrDeJcPFRSvW820eT_2LNsBv3H48YIYgm07-tBwXHUYvemTj9FFU_WZRFhcMM

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:fcb8:22d2:d390:5f1b , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9EC4
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJaGxwOBgUukouMkEHHcZ5e7_L4gpv5StmR7uy...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJnQUFBVFZxa0hyYQ&google_push=AYg5qPJaGxwOBgUukouMkEHHcZ5e7_L4gpv5StmR7uyKAIWmIHbjr_so90X1RJ1cQMj885W_rh47nJx0-c9AYWPevdRqwdKN69Md

170 B
188 B

63ms
62ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJnQUFBVFZxa0hyYQ&google_push=AYg5qPJaGxwOBgUukouMkEHHcZ5e7_L4gpv5StmR7uyKAIWmIHbjr_so90X1RJ1cQMj885W_rh47nJx0-c9AYWPevdRqwdKN69Md

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJnQUFBVFZxa0hyYQ&google_push=AYg5qPJaGxwOBgUukouMkEHHcZ5e7_L4gpv5StmR7uyKAIWmIHbjr_so90X1RJ1cQMj885W_rh47nJx0-c9AYWPevdRqwdKN69Md
Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9EC4
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK6CTmV...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPK6CTmV...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPK6CTmV_Ddr-FMgZxYLnjBcKF2fUAM4OmX4OLhYy8cVaohPbKogupd17ajtSUF_4Y...

170 B
188 B

65ms
65ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPK6CTmV_Ddr-FMgZxYLnjBcKF2fUAM4OmX4OLhYy8cVaohPbKogupd17ajtSUF_4YMtHXS54--U82HhdjVdfcIeds70Z6to

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPK6CTmV_Ddr-FMgZxYLnjBcKF2fUAM4OmX4OLhYy8cVaohPbKogupd17ajtSUF_4YMtHXS54--U82HhdjVdfcIeds70Z6to
pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 29 Nov 2021 11:26:18 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 9EC4 43 B
350 B 64ms
22ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESECFHMXv1L-maYWExtOpxD9Q&google_cver=1&google_push=AYg5qPLIKcDtdM9BMIW5XW5naLWymj0V3f-BWsvZU65hEsGBds7L02yLq0fuawgYNsfp8d_Y9-urrTf2s0ImMFh1aAotfjd2s4l6
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=2449947586&adf=2847098451&pi=t.aa~a.2964927557~rp.2&w=383&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=383x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1541&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280&nras=5&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=3699&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=4&fsb=1&xpc=wSxp47vDvn&p=https%3A//blogtuan.info&dtd=74
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:17 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: n2v3oubjleje1mlr8a1tfo7gp7u5b5t1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9EC4
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

63ms
62ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ4UwA_6WHD812JMcmgzySPi03Oucw4hwk1LbI-RTVQGhU6c0w9fftT6U_SvmFOHLuuvJgsGHQNxfwgygXDnaJaUamaZthA

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJ4UwA_6WHD812JMcmgzySPi03Oucw4hwk1LbI-RTVQGhU6c0w9fftT6U_SvmFOHLuuvJgsGHQNxfwgygXDnaJaUamaZthA
date: Mon, 29 Nov 2021 11:26:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9EC4
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEKMP2LF-QufbPGGUQZ3k33U&google_cver=1&google_push=AYg5qPK2UvqNQv6a4mbHKoMU-zngGQ0x6k2JT_n3vOOJmEj_dOOjnIpueFQwcty25Z-hBSYbeZQ...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQOU0tSS1OWlo=&google_push=AYg5qPK2UvqNQv6a4mbHKoMU-zngGQ0x6k2JT_n3vOOJmEj_dOOjnIpueFQwcty25Z-hBSYbeZQ9fqTmLRWvTVPRiMdBQPwdZ7Dl

170 B
188 B

65ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQOU0tSS1OWlo=&google_push=AYg5qPK2UvqNQv6a4mbHKoMU-zngGQ0x6k2JT_n3vOOJmEj_dOOjnIpueFQwcty25Z-hBSYbeZQ9fqTmLRWvTVPRiMdBQPwdZ7Dl

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQOU0tSS1OWlo=&google_push=AYg5qPK2UvqNQv6a4mbHKoMU-zngGQ0x6k2JT_n3vOOJmEj_dOOjnIpueFQwcty25Z-hBSYbeZQ9fqTmLRWvTVPRiMdBQPwdZ7Dl
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 9EC4
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIbFNAgEf8GMKvrwdwbRQo4&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_push=AYg5qPI_qdpvJtU1z8kgVWhRcbnGQLveLGBfVmvw-y2T8FaDg66CP68Zjlwj6ELzF6GOar64LgVm...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9EC4 0
12 B 63ms
62ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I1VZieDG10Hil4ctcMUuEbezsi7Xlnf5iDhiQ5bYt1CKoSxog_GuhSTyVkRHMYGtKV6Ejr

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 610B
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

127ms
126ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 29 Nov 2021 11:26:18 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Mon, 29 Nov 2021 11:26:18 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1444
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1

43 B
894 B

36ms
34ms

Image
image/gif

184.51.9.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COLKyrsCEM2AjLwCGOC1vLcBMAE&v=APEucNXe0PayAg46Xtz3r1JqH3-aokmHtJzw8HFDPO62jXVN5yQceLl_5dcthmMnzMjHCamMIIpvNaeUax29YfanVh7vxND2-XEhhZ1o8aj-G8UilS3HG3Nhmcp3CF2Rt__MNT9c2RFPVpHUz6ZVVdvxDOktagAYuMdQ3bpvG1Eb2Qdi5zP3e3g
Protocol: HTTP/1.1
Server: 184.51.9.98 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 29 Nov 2021 11:26:18 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1444
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YaS42enVbr8Gi.MWeoCQnwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1&google_hm=2

43 B
894 B

40ms
40ms

Image
image/gif

184.51.9.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COLKyrsCEM2AjLwCGOC1vLcBMAE&v=APEucNXe0PayAg46Xtz3r1JqH3-aokmHtJzw8HFDPO62jXVN5yQceLl_5dcthmMnzMjHCamMIIpvNaeUax29YfanVh7vxND2-XEhhZ1o8aj-G8UilS3HG3Nhmcp3CF2Rt__MNT9c2RFPVpHUz6ZVVdvxDOktagAYuMdQ3bpvG1Eb2Qdi5zP3e3g
Protocol: HTTP/1.1
Server: 184.51.9.98 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 29 Nov 2021 11:26:18 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 1444
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGGyBG4EEuBt4HjGX7ZdApc&google_cver=1

43 B
1008 B

9ms
8ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGGyBG4EEuBt4HjGX7ZdApc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COLKyrsCEM2AjLwCGOC1vLcBMAE&v=APEucNXe0PayAg46Xtz3r1JqH3-aokmHtJzw8HFDPO62jXVN5yQceLl_5dcthmMnzMjHCamMIIpvNaeUax29YfanVh7vxND2-XEhhZ1o8aj-G8UilS3HG3Nhmcp3CF2Rt__MNT9c2RFPVpHUz6ZVVdvxDOktagAYuMdQ3bpvG1Eb2Qdi5zP3e3g

Protocol

HTTP/1.1

Server

37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: d87d1fec-4712-4dd0-9b56-61ef6acadaef
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGGyBG4EEuBt4HjGX7ZdApc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1444
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D

170 B
188 B

68ms
68ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 11093d75-bd3f-4f9d-aa05-469dc959ae92
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 12EC 35 KB
13 KB 41ms
38ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16694
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame 21DA 2 KB
1 KB 732ms
116ms Script
text/javascript 204.154.111.142
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?jsCallback=__verify_callback_804795109087&jsTagObjCallback=__tagObject_callback_804795109087&num=6&ctx=10849334&cmp=26506175&plc=316870879&sid=2787705&advid=&adsrv=&unit=300x250&isdvvid=&uid=804795109087&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&dvp_strhd=0.20&dvpx_strhd=0.20&brid=3&brver=96&bridua=3&dup=null&chro=1&hist=2&winh=280&winw=379&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=2&htmlmsging=1&m1=13&noc=4&fcifrms=12&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=148&eparams=DC4FC%3Dl9EEADTbpTauTau3%3D%408EF2%3F%5D%3A%3F7%40TauU2%3F4r92%3A%3Fl9EEADTbpTauTau3%3D%408EF2%3F%5D%3A%3F7%40Tar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6ETar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6E&dvp_exetime=6.70&callbackName=__verify_callback_804795109087
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal100.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.142 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb29.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: ffa089cbeb44e7e26d76e64620244cbd5c69346610e5007f417001ddc74f2409

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
X-DV-Response: 1
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: max-age=0
Transfer-Encoding: chunked
Date: Mon, 29 Nov 2021 11:26:17 GMT
Expires: 11/28/2021 11:26:18 AM

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 37B4 41 KB
15 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 12:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 427062
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 24 Nov 2022 12:48:36 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1C99 1 KB
750 B 52ms
52ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 13:26:12 GMT
expires: Mon, 29 Nov 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 79206
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 37B4 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: de757f775a9ee010dcc57754e66caa1cc7c974bb1ab962909507bb806a278e57

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame E5C0 4 KB
619 B 48ms
48ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3766246314&adf=4214349505&pi=t.aa~a.2964928988~rp.2&w=395&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=395x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280%2C417x280&nras=7&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=4347&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=lLgdFIHTY6&p=https%3A//blogtuan.info&dtd=80

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 09:46:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 29 Nov 2021 11:26:18 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 29 Nov 2021 11:26:18 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame E5C0 1 KB
894 B 40ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:22:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 239
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 853
x-xss-protection: 0
server: cafe
etag: 7170004918125193417
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:22:19 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B441 22 KB
8 KB 40ms
39ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 24 Nov 2021 12:48:37 GMT
expires: Thu, 24 Nov 2022 12:48:37 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 427061
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7465 41 KB
15 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 12:48:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 427062
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 24 Nov 2022 12:48:36 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 35F0 1 KB
750 B 40ms
40ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 13:26:12 GMT
expires: Mon, 29 Nov 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 79206
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame E5C0 19 KB
8 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

65623c8434f7dadaba113a4521a101729ee3e6635e4412f2ccc99fbe6412d15e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:20:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 369
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7840
x-xss-protection: 0
server: cafe
etag: 9525834815172239946
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:20:09 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame E5C0 2 KB
1 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:11:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 898
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:11:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E5C0 119 KB
36 KB 58ms
57ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:26:18 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame E5C0 15 KB
6 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:21:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 310
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:21:08 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E5C0 0
0 50ms
48ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT7MfANopsjJRYv2U6u1Zw3FzCG9sJeX8RBM7n8M_d3oa64GVEUnm9PpkJnExjcLOZ8tHrfT3wPw909zxMGovxhnsAEuw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3766246314&adf=4214349505&pi=t.aa~a.2964928988~rp.2&w=395&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=395x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280%2C417x280&nras=7&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=4347&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=lLgdFIHTY6&p=https%3A//blogtuan.info&dtd=80
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

GET
H3 200 163b3e9c260ab6fd774ac5b5c6fd1d76.js Show response
www.gstatic.com/mysidia/ Frame E5C0 27 KB
11 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/163b3e9c260ab6fd774ac5b5c6fd1d76.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de418fdfa1d02a219d049bb1cd8562182c4201c67f6b9d0e2f67f21a476e1096

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 12:44:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254518
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11360
x-xss-protection: 0
last-modified: Tue, 16 Nov 2021 04:29:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 24 Feb 2022 12:44:20 GMT

GET
DATA 200
OK truncated
/ Frame E5C0 206 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 76ebd2a7078570fa9f6a50855b4ade57c6b558cca7c95801b2b247406b274975

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 7465 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 91fd0ef9e962dded0595ac9717aef0b43daf12895c87b270107e47381dd7e3ef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E5C0 0
0 86ms
85ms Fetch
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C-S_U2bikYcxnjott_Pa-2AnmicjnZoDlqbOlDqzQrJ7oFRABILKy4YsBYJXikIKgB6ABguDzvAPIAQmoAwHIA8sEqgTXAU_QvTtvuaEGlEryAxHdXP-oO4NW2XdUsAkgHPamdIK5LqdOzE8wwVdem1GpPdESSjwHYt_Vx4XUFx_i6lqtea9nS7qZLPvdW5K8rnA4oU6V18G5lKIf5N2p8kYJGF8rXYAbzOUUPcGJpe6oHmHUKaZDg4KRtIYcJ7v1Ym9XHT8Eck7BJ_yqxHNzRQbqqsSjEc4OqanSUx2DFPSv15dveSxCoLg0m070ClwGyz7g4RgUlohAu7eTIrVDzQQNieXgswJ3CX9Le-64QyEqUy10IRyjCkemKMYAwASr4La2iQKSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGLoAH5p-MQ6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcEEKrIG9IICQiA4YAQEAEYX4AKAcgLAdgTDYgUAdAVAYAXAbIXHAoaCAASFHB1Yi02MDgyMjI2MDgyNzkzNTg4GAA&sigh=PISWdzCebdw&uach_m=[UACH]&template_id=484

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3766246314&adf=4214349505&pi=t.aa~a.2964928988~rp.2&w=395&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=395x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280%2C417x280&nras=7&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=4347&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=lLgdFIHTY6&p=https%3A//blogtuan.info&dtd=80
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Mon, 29 Nov 2021 11:26:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0B97
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1

43 B
894 B

38ms
37ms

Image
image/gif

184.51.9.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhi3vqi7ATAB&v=APEucNWsSQiquCjAw1tTQiFO7YhDQQ8YgKcSw0mAzJzPnT4YsU9Hgj54ZtAbbcATOpl5Zl6cwOjVu84ebJ7eFOpyfJWO-AiSXA_Ew9_Jh8bBDgPqSEoQYYktrL_UyYWeU8LYeg140vPO6e5oQRQUPb7ln279U7PKisDKJhUV1F9e7_Vugo6uR_c
Protocol: HTTP/1.1
Server: 184.51.9.98 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 29 Nov 2021 11:26:18 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0B97
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YaS42enVbr8Gi.MWeoCQnwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1&google_hm=2

43 B
894 B

49ms
49ms

Image
image/gif

184.51.9.98
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhi3vqi7ATAB&v=APEucNWsSQiquCjAw1tTQiFO7YhDQQ8YgKcSw0mAzJzPnT4YsU9Hgj54ZtAbbcATOpl5Zl6cwOjVu84ebJ7eFOpyfJWO-AiSXA_Ew9_Jh8bBDgPqSEoQYYktrL_UyYWeU8LYeg140vPO6e5oQRQUPb7ln279U7PKisDKJhUV1F9e7_Vugo6uR_c
Protocol: HTTP/1.1
Server: 184.51.9.98 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-51-9-98.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Mon, 29 Nov 2021 11:26:18 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEA9JYe5zpyPPgyw3IAVqi3A&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 0B97
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGGyBG4EEuBt4HjGX7ZdApc&google_cver=1

43 B
1008 B

20ms
20ms

Image
image/gif

37.252.172.250
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGGyBG4EEuBt4HjGX7ZdApc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhi3vqi7ATAB&v=APEucNWsSQiquCjAw1tTQiFO7YhDQQ8YgKcSw0mAzJzPnT4YsU9Hgj54ZtAbbcATOpl5Zl6cwOjVu84ebJ7eFOpyfJWO-AiSXA_Ew9_Jh8bBDgPqSEoQYYktrL_UyYWeU8LYeg140vPO6e5oQRQUPb7ln279U7PKisDKJhUV1F9e7_Vugo6uR_c

Protocol

HTTP/1.1

Server

37.252.172.250 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 241c3ba6-b013-41e8-9c6f-5ec71e6f0d60
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGGyBG4EEuBt4HjGX7ZdApc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0B97
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D

170 B
188 B

64ms
64ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
X-Proxy-Origin: 185.213.155.162; 185.213.155.162; 538.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 0b2463c2-2bd3-4c21-954b-bd60dc7e66f9
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Njc2MjQ4NTU0MzI3NjQ0NDMwNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/17817395587843096576/ Frame D92A 45 KB
11 KB 98ms
53ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2ce2de1ea7c350c0459ec29bad50cd0cbf2f753dfcfa17c62348e4e4c8074eaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:18 GMT
expires: Tue, 29 Nov 2022 11:26:18 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 24 Sep 2021 03:34:58 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 37B4 0
571 B 169ms
81ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvd06aebIewDmJA8Tqcv6IfcbCew12BuX_rgt2SsYEb6LD6zl8tJY0Q8WS6XUeKCri2P103onbQc4M9I_QTA7fAznRKRn4gM4K0v9wgYaS_71hhuI-FO7U3umrkaCluCNr0eIOlxm5wuODubzu3r42yNBdxlA9cwQzS56oaLQroL4HgJulmEeylAFVkaKXHxVzT-l_QRf0PXk-bDR_ytBnOjkmxl9vW5zZHb0xKn__LWfnzFqC4_D8L29H4g61r8IifMdBgnFhMLjgkxT6pX6HQUAMPglTbNpPJL-WK6LwtkIi7aeMhm0EJT0WqblaJizJXAT7cMmD47AQLQmC9okPE-Xn0XmZN2fI30jjxSkPFhcxuj6EZj3ATxLhgjw1CqPC5_d0FUky0rlzIUYywyGWMxKBvmGFEQusgJwi6Acz8pVHjDNokm4fG4vyw5y2iLaKx-QclW-6QGvLwlNTagRawMIQxpzgQQejmpmo2G9CUpS3JyaXrJOwLHCgX4GLVwu3XrvlT_55CJeWOd69UzvO9CEJ13Awtbchjuc-JN3keJRjckDE1O-bnoKgsASEOfdzRPiXDTxef7r3RoOIaATpY_c1aUv-HGKr3ekvE6M6F_rFGphlqmvYiZjKijGuFn8QxlH9XccRC_uhHE07IIKKFHiWdXULCNfk8bPIzVzg3XG2jg0HLW2eb8enKR0TRwVzOLTXqMuc2Up0gg6uby2GUO5TkwkrO7cqACDgrD78h_eo2MsFH9hmpAT1_hcfnjSNHJYhZXNii4v_e_YwoBt28Xg5AjU4FEmZT5hZHUMAiuhWpsblMnfrYbM-jItXsCHAzmc_RqsRZzlkORRjRTFrItrS1_yfpcrjH3gqr_EgupotrdzVmZn-A6TSnu5oyJZEuaod72BFAP8yAtAkgzfPVLZRQEt_vXMq2sbSKKOLksZp58ZBvXWjBTO-hLB8-BgigS5xCk-djn8cHAUWg1o_b8FXwS1qk94VMnLvNiZEXlMinUmI9Enh-_QeDWiAT9TnP8BGGrrAKe1XOKrfWPX7BhnYCRYzR3USgqkc2qDyIGl9QIOHxufn4keE1yShvDjdjVyAXX5dLyF0C_eqGD21MY-tbwrW63GKTpmcouj0neToCu7g_I12UTWHsoOnqHfffyowAFiiQLM7knkQ5I69yC2dsia96YXyNpXWPBmx9aVizZqzeJwC2imPdWg&sai=AMfl-YR6FBfnNNqY3iu4MU6u9LilZxBMGyrMwmskqEUfG9-E_ylm2pEU3b4C43Hkq70bxYIV2hlPp445JVCPczPXPnVwM4NR1Fr4EjN7DU4uX-4pXZKadaZ1Fc75G4yH8nwb_XiMcle6Mw7-zzDFMoR_7UEZKwlhWQ&sig=Cg0ArKJSzDe793s6FwRWEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=465&cbvp=1&cstd=459&cisv=r20211111.81707&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 29 Nov 2021 11:26:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/ Frame 8311 129 KB
25 KB 70ms
38ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d9c88b93752c9fe50d2f46f71ce8eb45a4a34d36c5532e550ffffd293dc175e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Wed, 24 Nov 2021 23:00:38 GMT
expires: Thu, 24 Nov 2022 23:00:38 GMT
last-modified: Wed, 17 Nov 2021 14:10:19 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 25372
age: 390340
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7465 0
61 B 162ms
84ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv3EdwiI2Hw2iScFuMi83BJZ8XseNu4_KkSaszXVOat5cH-Fn3acoKFwewONIAoBwPCVij5RG60LsrdNVo_P0A4XzzeM5ohYrUQHNhbWE0hcIREpwLN84xGYXar8MZ6uC1L6A9hHeMeH7zZB2zM2ac4T9OAQBiSHPx2Qj6r-oZCu2viGVwUR61tMf782dhLPxAfYLJ-Wu5QBYo86WNmhhEFOhQFmzfQq4zlpK1XqOxuw77eDqFuemz_zJyRuTCglN26vjDMPPduXY4ExuZ2Re5x4WX4mZiISigR5gT_VV8aZGPa8lf1GSq2ishYC7zadeTmZpajVcUvH3QQWCv_a-ypbDUACA3POEBYelqhM_0-tSWbO3ln-SfooS3mHBV2XxLPT1sMhcO3EtiukjrLiIshyyVt81MnpbgJ9lG-YlsZPuQIwZDgga9qqbA2ZRvfg9UcxTVSp-yH4q4swPx8s8jrRQwL6fXy9wViCWJ8vf3TLeSFKczABs3I28mFtsMGCjc8hOa7bCquiZvQuk-VRFyYmQrxWp3I58_W23u3hO_u3m5EuaR6YMFKWhZys1BcCQxUrq1uhiaIT38p0ya5otswtqTlSK8bgy9_OdZSk5Ji_CJfDOqwzcRZsG4ybijWX6U_CLl2TaLfOb52DyK3GzhbddHd-MuM4qwy6Cv_ekJU8EiPjw06zkpuxkxmeHxwB8fhDmlFgB-tfWx33Hi01jc1XWK0yIF_5SS5cnqkp_7Z-U2JJkuVTDOYLFPhRJNGHdFOzhSsu2vqFEyxc3m3-VPHMM36uHYJkpUmUHXvVwkq-Vvl-2H9CnEhLbyWMB66Q-0Ptf-JlIGROVwLZe0fgknjRocUwkOAolOLM6XoUoNp5iO_5mkZW80fjc9vni9p0KSFOdDOS2X510ppmtLcEcrA8S1Suikg2Dtpu2903EUu6j-0tV8cowZuz3YofP5-g5QGEFIRcN_Wi4EVu_xKmQkJC-XMSjAwPCYhD2WfYdMkVAOXxhZg28KOeZ4gsed86I0gXYzjF9vHRxH9h8SPtbTLOwewWxHi1pCYg6g3ZjVix1KxVfk_XRqkFmbdkhst0KS9XrJj3ihE4rtUPgmpvHXBOPVY6w7Pe_1FJKPiDc8yM-pR5QC6XlaeTIq-lsWazV6QbAbuNnL9Ztm2Z3poowqK&sai=AMfl-YQL5Z0Bu1ugZC7Dx_J5TH3n71BitXKZwvqvqfmqjZ6o2GbmkjvhH5pfNtjrLLo6RmT8GDTOHFO_Sl7UGfgrKs3EIRBZGstKbSZBK-COdJ4ASlyfgX7HfLVjjON-t5vKwL0Cqdap4eUxS1ra35TVnoU3T6G7DZrytx4zly38Zn098vJLS7DvERjhu76wjyIquoMgm_RJLFAAQEh9sH4OWevSr2ryDmcf5scqbuQeXjNLVmRgUqul7E8LGx4-uPbpOc848c1CYMKiRjfVd-yTyvazGStauypE2WHDbx_ftPJn&sig=Cg0ArKJSzEgdzR7Vs0n4EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=366&cbvp=1&cstd=364&cisv=r20211111.79952&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Mon, 29 Nov 2021 11:26:18 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4D6C 22 KB
8 KB 37ms
37ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 24 Nov 2021 12:48:37 GMT
expires: Thu, 24 Nov 2022 12:48:37 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 427061
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E7F5 42 B
64 B 75ms
74ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuy6UZ94cyhvaG9SiVd1sYAZmt8hyh527DhHWikRiLUffPSvCOBZ06aoz_n0c-9MCcXA_ebHkh8AcHXacuOriwaletYCb5MHKf12yk8qADv8vAKnh2FIA&sai=AMfl-YRB15Ug5RVZ0vyLB_7L5MbrRzkzp7-ODafrBxpE-_ZpTGCvmouV9Lmpj2VjErZNOHyij5IXlAM5UCyX&sig=Cg0ArKJSzAqTdvruO9dFEAE&id=lidar2&mcvt=1107&p=0,0,198.46875,770&mtos=1107,1107,1107,1107,1107&tos=1107,0,0,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=165382125&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638185177162&rpt=229&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK request_content.php Show response
hal90002.redintelligence.net/ Frame 61B6 8 KB
3 KB 34ms
11ms Document
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/request_content.php?s=94786400065214000757623011793002&a=6c7cc0db
Requested by: Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: 9cfe6b948d6d2147319e27153d2947e126084f34c6060fcda288e515c0777c7c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/

Response headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Mon, 29 Nov 2021 11:26:18 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2187
Connection: close
Content-Type: text/html; charset=utf-8

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B56F 1 KB
750 B 39ms
38ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 13:26:12 GMT
expires: Mon, 29 Nov 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 79206
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 kwanko-sdk-iframe.html Show response
img.metaffiliation.com/ Frame 36B5 3 KB
991 B 14ms
14ms Document
text/html 192.229.220.129
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://img.metaffiliation.com/kwanko-sdk-iframe.html
Requested by: Host: img.metaffiliation.com
URL: https://img.metaffiliation.com/na/na/res/trk/script.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.220.129 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (muc/334D) /
Resource Hash: 2d43c04a2d2f68039cedc241e492503a5e0d93a2cafb3be130993b3e3dfd8d4a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/

Response headers

content-encoding: gzip
accept-ranges: bytes
access-control-allow-origin: *
age: 230
cache-control: public, max-age=600, s-maxage=3600
content-type: text/html
date: Mon, 29 Nov 2021 11:26:18 GMT
etag: "5fd78d26-ac5"
last-modified: Mon, 14 Dec 2020 16:04:54 GMT
server: ECAcc (muc/334D)
vary: Accept-Encoding
x-cache: HIT
content-length: 891

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BE68 1 KB
750 B 41ms
40ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 13:26:12 GMT
expires: Mon, 29 Nov 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 79206
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 49DD 22 KB
8 KB 37ms
37ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 24 Nov 2021 12:48:37 GMT
expires: Thu, 24 Nov 2022 12:48:37 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 427061
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6042 42 B
64 B 74ms
74ms Fetch
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstJtws-zBox1ruS5Ayw_LH8JSU0sWOIGC7E6ocE7wPx0GE3IKZFzU7Uc40bq8R1i2nyXNE5NYe2beIO547sIMp5JB_JG63raS6tdORi33Sh0zRjNNCCNQ&sai=AMfl-YQt_6J9fSfpHjxACsHSH-ezqnHZ2NeOOSP-YBKmQMSPSeXwyZfqCsb02212Qd0assbvS5xEVGK7tRzA&sig=Cg0ArKJSzCfMA4RtjF9eEAE&id=lidar2&mcvt=1036&p=0,0,124,1005&mtos=0,782,1036,1036,1036&tos=0,782,254,0,0&v=20211110&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=2969136041&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1638185177031&rpt=419&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 peg_logger.js Show response
singles.parship.de/static_cms/parship/static/peg_utils/peg_logger/ Frame FDA4 12 KB
4 KB 21ms
17ms Script
application/x-javascript 2606:4700::6813:ba79
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://singles.parship.de/static_cms/parship/static/peg_utils/peg_logger/peg_logger.js

Requested by

Host: singles.parship.de
URL: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:ba79 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1899d905fa63b9ac69141963481e3fe903766aa4f55782731dac7a99def72215

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 74040
strict-transport-security: max-age=15552000
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 09 Nov 2021 08:10:54 GMT
server: cloudflare
etag: W/"618a2d0e-2e56"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=86400
cf-ray: 6b5b7af62c761f2d-FRA
expires: Mon, 29 Nov 2021 14:52:18 GMT

GET
H2 200 pegtracking_combined.js Show response
singles.parship.de/static_cms/parship/static/peg_utils/tracking/ Frame FDA4 29 KB
9 KB 34ms
30ms Script
application/x-javascript 2606:4700::6813:ba79
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://singles.parship.de/static_cms/parship/static/peg_utils/tracking/pegtracking_combined.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:ba79 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1baecde592fc2970ed07fd23c1c63e7c7f7cc7bc7e1c89a87d2171dfa20bbe73

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 12691
strict-transport-security: max-age=15552000
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 23 Nov 2021 07:50:03 GMT
server: cloudflare
etag: W/"619c9d2b-723e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=86400
cf-ray: 6b5b7af62c8d1f2d-FRA
expires: Tue, 30 Nov 2021 07:54:47 GMT

GET
H2 200 v64f9daad31f64f81be21cbef6184a5e31634941392597 Show response
static.cloudflareinsights.com/beacon.min.js/ Frame FDA4 13 KB
5 KB 84ms
66ms Script
text/javascript 2606:4700::6810:5e41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Requested by: Host: singles.parship.de
URL: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5e41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5bf0a170ae91f1bb8d0c94381a74ab8b85f938bf31bf18a9c8e3b835250d3be6

Request headers

Referer: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID
Origin: https://singles.parship.de
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: gzip
last-modified: Fri, 22 Oct 2021 22:23:12 GMT
server: cloudflare
etag: W/2021.10.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6b5b7af698964aa3-FRA

GET
DATA 200
OK truncated
/ Frame E5C0 207 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 59515c0c1430804cf005af59a7c53160625b3d627716828c380335b86e694017

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame E5C0 15 KB
15 KB 40ms
40ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 17:56:19 GMT
x-content-type-options: nosniff
age: 408599
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 24 Nov 2022 17:56:19 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C99
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEELXO2xo9pOlw7Uj4MDqWJs&google_cver=1&google_push=AYg5qPKMDJL6xi1_qkybpLiGNXoulPxXgcF1zgjOzpPT5sl5jCxwFtLveB...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKMDJL6xi1_qkybpLiGNXoulPxXgcF1zgjOzpPT5sl5jCxwFtLveBMWh1smDhuMjUmlObkcNeEeEQTUYlCOJfGbGqefDIs&google_hm=Z9FKLIN...

170 B
188 B

64ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKMDJL6xi1_qkybpLiGNXoulPxXgcF1zgjOzpPT5sl5jCxwFtLveBMWh1smDhuMjUmlObkcNeEeEQTUYlCOJfGbGqefDIs&google_hm=Z9FKLINTyqyJmLP3brOQtA

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKMDJL6xi1_qkybpLiGNXoulPxXgcF1zgjOzpPT5sl5jCxwFtLveBMWh1smDhuMjUmlObkcNeEeEQTUYlCOJfGbGqefDIs&google_hm=Z9FKLINTyqyJmLP3brOQtA
pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C99
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPJNGuzERO5SBeGiM3OzaRgTHcE-_xf5mIqHjvL...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJnQUFCUTE4dTFlaw&google_push=AYg5qPJNGuzERO5SBeGiM3OzaRgTHcE-_xf5mIqHjvLOjMxZi7LJUBQ6OV2gP7YOwhjAiQuzivajyPYkE4a-HozxLKQEYfyieks

170 B
188 B

49ms
49ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJnQUFCUTE4dTFlaw&google_push=AYg5qPJNGuzERO5SBeGiM3OzaRgTHcE-_xf5mIqHjvLOjMxZi7LJUBQ6OV2gP7YOwhjAiQuzivajyPYkE4a-HozxLKQEYfyieks

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWFTNDJnQUFCUTE4dTFlaw&google_push=AYg5qPJNGuzERO5SBeGiM3OzaRgTHcE-_xf5mIqHjvLOjMxZi7LJUBQ6OV2gP7YOwhjAiQuzivajyPYkE4a-HozxLKQEYfyieks
Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Connection: keep-alive
Content-Length: 390
Content-Type: text/html; charset=iso-8859-1

GET
H3 200 dds
rtb.openx.net/sync/ Frame 1C99 43 B
64 B 40ms
24ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEGVmypiSj-_PVY_hRDlUX4o&google_cver=1&google_push=AYg5qPKRbC8evI81LdZbdrepuyWHy0PjHBQRlhUF3ddQPiAWnyfOaJPrqwEREORgHBdhaeTgqlhAes_G4qPijHym-oKVSDqrLQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=472186380&pi=t.aa~a.508084115~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=2&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280&nras=4&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=3114&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=3&fsb=1&xpc=Pun8NNpk3m&p=https%3A//blogtuan.info&dtd=71
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: sidgb7ccr5mihbf9jag78t27s4bmoe4f

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C99
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

52ms
52ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIwbnJwdUlZfwV6y4pK0Un4kj4rjfhyheaU4J_wmyFDgIXNwnPXLaEoRouGqtsME7WhMGL7dHVhgsOGyUnFDqLGs-REHgk

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIwbnJwdUlZfwV6y4pK0Un4kj4rjfhyheaU4J_wmyFDgIXNwnPXLaEoRouGqtsME7WhMGL7dHVhgsOGyUnFDqLGs-REHgk
date: Mon, 29 Nov 2021 11:26:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C99
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOp6d6M0xJ52pPkkADZhGuI&google_cver=1&google_push=AYg5qPKghhUze9iNuogUDRscLUTQAAOvh8X12ldbc0cXLFUQUktdKKWER9MRgG0d1DOh88n-I-p...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQT0MtMTAtNUVRVQ==&google_push=AYg5qPKghhUze9iNuogUDRscLUTQAAOvh8X12ldbc0cXLFUQUktdKKWER9MRgG0d1DOh88n-I-pyDsm4kx8jgCBRBfNy8OeJRA

170 B
188 B

65ms
65ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQT0MtMTAtNUVRVQ==&google_push=AYg5qPKghhUze9iNuogUDRscLUTQAAOvh8X12ldbc0cXLFUQUktdKKWER9MRgG0d1DOh88n-I-pyDsm4kx8jgCBRBfNy8OeJRA

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQT0MtMTAtNUVRVQ==&google_push=AYg5qPKghhUze9iNuogUDRscLUTQAAOvh8X12ldbc0cXLFUQUktdKKWER9MRgG0d1DOh88n-I-pyDsm4kx8jgCBRBfNy8OeJRA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 1C99
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEFGAaDWs2cjcH0HbSDvlxzI&google_push=AYg5qPKvddPWf6FG5cvWr7biF2t5YwrdqkmZc...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1C99
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEHAWhuYTt0FXIV2nXUwpgvY&google_cver=1&google_push=AYg5qPLQtiJrX7Q70Sl_D-Ah8e7YhzB4ZKIzeWZRcRffQ9KMJEkuEvroydFjmBdRcv5Y5ijbwCjf1RsPpR4u4HOZikkqHWE...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLQtiJrX7Q70Sl_D-Ah8e7YhzB4ZKIzeWZRcRffQ9KMJEkuEvroydFjmBdRcv5Y5ijbwCjf1RsPpR4u4HOZikkqHWE86bs&google_hm=-nN0QU-YQa2jMm77M...

170 B
188 B

73ms
71ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLQtiJrX7Q70Sl_D-Ah8e7YhzB4ZKIzeWZRcRffQ9KMJEkuEvroydFjmBdRcv5Y5ijbwCjf1RsPpR4u4HOZikkqHWE86bs&google_hm=-nN0QU-YQa2jMm77MG-lxQ

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLQtiJrX7Q70Sl_D-Ah8e7YhzB4ZKIzeWZRcRffQ9KMJEkuEvroydFjmBdRcv5Y5ijbwCjf1RsPpR4u4HOZikkqHWE86bs&google_hm=-nN0QU-YQa2jMm77MG-lxQ
pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: no-cache
content-length: 0
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1C99 0
12 B 61ms
60ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IoSoYNNWlYPqGMjr83YE3eVTmlUSylCbmwz9gDvAIsNcoQwLM-eX-YHELAh5sSUI02nVEl

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35F0
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEOVF7AYtOXs9qFHsRK-Kymw&google_cver=1&google_push=AYg5qPKW7-GfuH_DbuERhV9em1wq5ABKNvt3ZSUdTRI7ejstZQYpQynLBT...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKW7-GfuH_DbuERhV9em1wq5ABKNvt3ZSUdTRI7ejstZQYpQynLBTCfsGHy53GVF_qriWO-htgtUd0fda--PcYRIngPJigh&google_hm=Z9FKLI...

170 B
188 B

63ms
62ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKW7-GfuH_DbuERhV9em1wq5ABKNvt3ZSUdTRI7ejstZQYpQynLBTCfsGHy53GVF_qriWO-htgtUd0fda--PcYRIngPJigh&google_hm=Z9FKLINTyqyJmLP3brOQtA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPKW7-GfuH_DbuERhV9em1wq5ABKNvt3ZSUdTRI7ejstZQYpQynLBTCfsGHy53GVF_qriWO-htgtUd0fda--PcYRIngPJigh&google_hm=Z9FKLINTyqyJmLP3brOQtA
pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35F0
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJjCxxa...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPJjCxxa9XhpJT64uqHPJWHtJ-LrdQSo1F7adFKNhl7aVdYK-xKCraYWiLudkpg3gc...

170 B
188 B

64ms
64ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPJjCxxa9XhpJT64uqHPJWHtJ-LrdQSo1F7adFKNhl7aVdYK-xKCraYWiLudkpg3gcKdKo-46RzfOT7QyGndKL27JrnS6Ir7SQ

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPJjCxxa9XhpJT64uqHPJWHtJ-LrdQSo1F7adFKNhl7aVdYK-xKCraYWiLudkpg3gcKdKo-46RzfOT7QyGndKL27JrnS6Ir7SQ
pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 29 Nov 2021 11:26:18 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame 35F0 43 B
64 B 33ms
23ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEPlWLR_HNnNeTRRCF28Cwdc&google_cver=1&google_push=AYg5qPIvdTya-0gwH0OeK-G6tlRzFZjSou_nFua53ceNhWr0wqdbFXccmBVOFfjREJ-iuH0HvrR0O1x_Z-7d3IjV-w7Si8ErKbvXtw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: vvrdk167dheivpmrvgec22q1ulsjg53k

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35F0
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

75ms
73ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJB0x0NkwngICxcnKShYWv9HtMetd-vJen93feThtNtncFX8WzHlgfxtbRW2DwrotcbbLWYr8vsl-6H8U4mBif_cSNoKoF6xg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJB0x0NkwngICxcnKShYWv9HtMetd-vJen93feThtNtncFX8WzHlgfxtbRW2DwrotcbbLWYr8vsl-6H8U4mBif_cSNoKoF6xg
date: Mon, 29 Nov 2021 11:26:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35F0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEOAKq2Ehp1b7ifkE1oLnfqo&google_cver=1&google_push=AYg5qPLFThHoHWagvfiKDWDG9xNmosI3508d-6M2F9l04WWfemv5-VYmqAPnnFuToNxZEcsfagQ...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQUDUtMUotOU01Tg==&google_push=AYg5qPLFThHoHWagvfiKDWDG9xNmosI3508d-6M2F9l04WWfemv5-VYmqAPnnFuToNxZEcsfagQIwt_PW_QjcIiOhpXZUXr4nUZXYw

170 B
188 B

65ms
64ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQUDUtMUotOU01Tg==&google_push=AYg5qPLFThHoHWagvfiKDWDG9xNmosI3508d-6M2F9l04WWfemv5-VYmqAPnnFuToNxZEcsfagQIwt_PW_QjcIiOhpXZUXr4nUZXYw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQUDUtMUotOU01Tg==&google_push=AYg5qPLFThHoHWagvfiKDWDG9xNmosI3508d-6M2F9l04WWfemv5-VYmqAPnnFuToNxZEcsfagQIwt_PW_QjcIiOhpXZUXr4nUZXYw
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 35F0
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEPmRgNlhxdf7SGQJ8JUHwUg&google_push=AYg5qPIi2jegI4uAGeTHkOgIshPZ3F-_W1uwJ...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 35F0
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEOkBXCrYV4kx0H1rOKrAfZw&google_cver=1&google_push=AYg5qPJzBuxT6dDLItoVunC4...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJzBuxT6dDLItoVunC46PY5ntoe4sq8KlnQc8NMcetDlJ3Yu0_2iVDPeq8WdQJvrgGxYyJs3GFsx-IslWL1SEMYghxuvFOLDhw&google_hm=

170 B
188 B

64ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJzBuxT6dDLItoVunC46PY5ntoe4sq8KlnQc8NMcetDlJ3Yu0_2iVDPeq8WdQJvrgGxYyJs3GFsx-IslWL1SEMYghxuvFOLDhw&google_hm=

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPJzBuxT6dDLItoVunC46PY5ntoe4sq8KlnQc8NMcetDlJ3Yu0_2iVDPeq8WdQJvrgGxYyJs3GFsx-IslWL1SEMYghxuvFOLDhw&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 28 Nov 2021 11:26:18 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 35F0 0
12 B 67ms
66ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JrE-0jj7pHCDPsbmI5A0sAedhTux6awgzp67H6MjUNANLS2fcBozNnKlwdOi5uIPjnt4t3DA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 css
fonts.googleapis.com/ Frame 61B6 4 KB
649 B 51ms
50ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=94786400065214000757623011793002&a=6c7cc0db

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ad246d47536dacf0256646042ec184678bfc630fcb638d9199bd66cf8cb5e457

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Mon, 29 Nov 2021 10:01:06 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Mon, 29 Nov 2021 11:26:18 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Mon, 29 Nov 2021 11:26:18 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 61B6 16 KB
16 KB 38ms
13ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/pb_goldschmied_1200x627.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=94786400065214000757623011793002&a=6c7cc0db
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9a3435b078b73afe8da74b1eb7968b410c7a0f11832c29aef0728061512a210c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16465
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 61B6 16 KB
16 KB 36ms
12ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/62726/creativesup/ESDE_MSS_Step2_Kleid_1200x627_251021_rs-IxQ56xIE.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=94786400065214000757623011793002&a=6c7cc0db
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: f0be126a2ec90504dd188cad587d2e65fd484b35928ee31bdd6d46f12e7bb23b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16240
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 61B6 15 KB
15 KB 177ms
153ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52343/creativesup/1200x627_2.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=94786400065214000757623011793002&a=6c7cc0db
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: daee867e7bba17752d6fa107982c8dcd3ceebd35db5b5e92169a9532dc90a86d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15249
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 61B6 7 KB
7 KB 36ms
12ms Image
image/png 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/51649/creativesup/PS_Herbstkampagne2019_Inga1_OnlineMarketing_Display_Yahoo_1200x627.jpg
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=94786400065214000757623011793002&a=6c7cc0db
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 194c322bc54f46a54555fe5b86098b2f0c5ecd009c6f79f0adc4d7b5310ddfef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 7155
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 8311 236 KB
63 KB 46ms
16ms Script
text/javascript 2a02:26f0:6c00::210:ba12
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:6c00::210:ba12 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: gzip
server: Apache
cache-control: max-age=900
vary: Accept-Encoding
content-type: text/javascript
x-n: S
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:41:18 GMT

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame B441 35 KB
13 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16694
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H3 200 Enabler_01_246.js Show response
s0.2mdn.net/879366/ Frame D92A 116 KB
39 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_246.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b64291fc91dc77833930ffcead244193c5cfd9e882af312ecc89b580160c22a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 28 Nov 2021 12:48:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81461
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40237
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 29 Nov 2021 12:48:37 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame D92A 60 KB
24 KB 67ms
66ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 29 Nov 2021 11:26:18 GMT

GET /
google2waycm.netmng.com/cm/ Frame B56F 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B56F
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEAeU7csgrQecJ2t3uANP0as&google_cver=1&google_push=AYg5qPLrQuEnb-MjRQFshot1SWAxPe3UKq0JQxwiRnLLl5mg0vgZkhwFQmqj1K4G4QfEWasMWzhvy_QKBfMdIB97...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPLrQuEnb-MjRQFshot1SWAxPe3UKq0JQxwiRnLLl5mg0vgZkhwFQmqj1K4G4QfEWasMWzhvy_QKBfMdIB97lUt2eUL-zQEQ

170 B
188 B

66ms
65ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPLrQuEnb-MjRQFshot1SWAxPe3UKq0JQxwiRnLLl5mg0vgZkhwFQmqj1K4G4QfEWasMWzhvy_QKBfMdIB97lUt2eUL-zQEQ

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: MT3 4103 f8fad19 master cdg-pixel-x28 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPLrQuEnb-MjRQFshot1SWAxPe3UKq0JQxwiRnLLl5mg0vgZkhwFQmqj1K4G4QfEWasMWzhvy_QKBfMdIB97lUt2eUL-zQEQ
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Mon, 29 Nov 2021 11:26:17 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B56F
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEKE1UfzYvAdb2siwVUuHJao&google_cver=1&google_push=AYg5qPIaJcjTXewKIW6UyzUq7NWySLDcFwQemKYlASEdQesHatylSrrzMgZHPXuaPiagvviaXqyWkKHUkA0eUBQxrOrh...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEKE1UfzYvAdb2siwVUuHJao&google_cver=1&google_push=AYg5qPIaJcjTXewKIW6UyzUq7NWySLDcFwQemKYlASEdQesHatylSrrzMgZHPXuaPiagvviaXqyWkKHUkA0eUB...
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=eae4e958-c628-4498-aa33-b0fa21a5bf2a&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIaJcjTXewKIW6UyzUq7NWySLDcFwQemKYlASEdQesHatylSrrzMgZHPXuaPiagvviaXqyWkKHUkA0eUBQxrOrhaE6A6ZGk&google_hm=wwCb0e5hRfCpImIVASLNIw==

170 B
188 B

64ms
64ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIaJcjTXewKIW6UyzUq7NWySLDcFwQemKYlASEdQesHatylSrrzMgZHPXuaPiagvviaXqyWkKHUkA0eUBQxrOrhaE6A6ZGk&google_hm=wwCb0e5hRfCpImIVASLNIw==

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIaJcjTXewKIW6UyzUq7NWySLDcFwQemKYlASEdQesHatylSrrzMgZHPXuaPiagvviaXqyWkKHUkA0eUBQxrOrhaE6A6ZGk&google_hm=wwCb0e5hRfCpImIVASLNIw==
Date: Mon, 29 Nov 2021 11:26:19 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B56F
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESECb1ooVEJ_3isXW1cMxXDSU&google_cver=1&google_push=AYg5qPIceZc9dHoqtqEY3wdB2b9VjyayOjnRryWNdhMv5hM_zzpfHhBpCaWrETI986jZ8GLK_nofoKmm...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESECb1ooVEJ_3isXW1cMxXDSU&google_cver=1&google_push=AYg5qPIceZc9dHoqtqEY3wdB2b9VjyayOjnRryWNdhMv5hM_zzpfHhBpCaWrETI986jZ8GLK_no...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTgwMTIwNzgwMjg3ODU1ODIzOQ&google_push=AYg5qPIceZc9dHoqtqEY3wdB2b9VjyayOjnRryWNdhMv5hM_zzpfHhBpCaWrETI986jZ8GLK_nofoK...

170 B
188 B

63ms
62ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTgwMTIwNzgwMjg3ODU1ODIzOQ&google_push=AYg5qPIceZc9dHoqtqEY3wdB2b9VjyayOjnRryWNdhMv5hM_zzpfHhBpCaWrETI986jZ8GLK_nofoKmmloN8Q1Upv-Cqwr4syh4

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MTgwMTIwNzgwMjg3ODU1ODIzOQ&google_push=AYg5qPIceZc9dHoqtqEY3wdB2b9VjyayOjnRryWNdhMv5hM_zzpfHhBpCaWrETI986jZ8GLK_nofoKmmloN8Q1Upv-Cqwr4syh4
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B56F
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEF...
https://sync.targeting.unrulymedia.com/csync/RX-c2dfd1e4-a374-45e0-a740-a2ddb0746ed3-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPJpPACZZnl_hVohp6ZoO...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJpPACZZnl_hVohp6ZoO4zEs39ryk154l_6Q5AYAHfScq4c-i9UKmd2boMSvfN-JveCQVpIZYp7zJ9LU46DFIoPQ9TVhSSv&google_hm=A8Lf0eSjdEXgp0Ci3bB0btM

170 B
188 B

63ms
62ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJpPACZZnl_hVohp6ZoO4zEs39ryk154l_6Q5AYAHfScq4c-i9UKmd2boMSvfN-JveCQVpIZYp7zJ9LU46DFIoPQ9TVhSSv&google_hm=A8Lf0eSjdEXgp0Ci3bB0btM

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPJpPACZZnl_hVohp6ZoO4zEs39ryk154l_6Q5AYAHfScq4c-i9UKmd2boMSvfN-JveCQVpIZYp7zJ9LU46DFIoPQ9TVhSSv&google_hm=A8Lf0eSjdEXgp0Ci3bB0btM
date: Mon, 29 Nov 2021 11:26:18 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXc2dfd1e4a37445e0a740a2ddb0746ed3003
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B56F
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECNWqEmpvH-xRkmul7yYnRc&google_cver=1&google_push=AYg5qPLET1CzvP_Yzskwa1beugV45yzsxBQyad3oafYfM9jOcGvCqP6_U_IwtIarUXv7Og5Ftr...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECNWqEmpvH-xRkmul7yYnRc&google_cver=1&google_push=AYg5qPLET1CzvP_Yzskwa1beugV45yzsxBQyad3oafYfM9jOcGvCqP6_U_IwtIarUXv7Og5Ftr...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1rQUguMWxORTJ1RWlBU1QyMmdnRkdGdjloWjFVSk5IRH5B&google_push=AYg5qPLET1CzvP_Yzskwa1beugV45yzsxBQyad3oafYfM9jOcGvCqP6_U...

170 B
188 B

65ms
64ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1rQUguMWxORTJ1RWlBU1QyMmdnRkdGdjloWjFVSk5IRH5B&google_push=AYg5qPLET1CzvP_Yzskwa1beugV45yzsxBQyad3oafYfM9jOcGvCqP6_U_IwtIarUXv7Og5Ftrnkv6pNPDZcLNhTre6WHbYF13E6Rw

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1rQUguMWxORTJ1RWlBU1QyMmdnRkdGdjloWjFVSk5IRH5B&google_push=AYg5qPLET1CzvP_Yzskwa1beugV45yzsxBQyad3oafYfM9jOcGvCqP6_U_IwtIarUXv7Og5Ftrnkv6pNPDZcLNhTre6WHbYF13E6Rw
date: Mon, 29 Nov 2021 11:26:18 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 200 dot.gif
s0.2mdn.net/ Frame B56F 43 B
65 B 60ms
59ms Image
image/gif 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEOHXBZQhFZbW9zHZIfv3i30&google_cver=1&google_push=AYg5qPLl-Ekx_FvATUnL9UoHuw7KTvZ1EDFVZr59MTwN3zYSJoSTmv2kV4P47lOk0kp5GCGhE_IVjv_C0DUw0JPaukvC2PqiRX2KUw

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 30 Nov 2021 11:26:18 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame B56F 0
12 B 64ms
63ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JmAoK_HsfhK1MvZ0_HbbKRhWH2Wu15QeeulF5iFhU6eZDJh-KrgkKitqy2Ycwl6qPD9EJuStk

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 4D6C 35 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16694
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BE68
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENy7ocW8-g6mig-fuZp9fd0&google_cver=1&google_push=AYg5qPJurAUZE3FKuDINKbFW2vPywsUPL-lL7XxfqcurdNucZzeHmB07JW...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJurAUZE3FKuDINKbFW2vPywsUPL-lL7XxfqcurdNucZzeHmB07JW9ifOoQb7mjdBtZq4ttjs1WCZ3jjiHW2kYd1aPi&google_hm=Z9FKLINTyq...

170 B
188 B

73ms
73ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJurAUZE3FKuDINKbFW2vPywsUPL-lL7XxfqcurdNucZzeHmB07JW9ifOoQb7mjdBtZq4ttjs1WCZ3jjiHW2kYd1aPi&google_hm=Z9FKLINTyqyJmLP3brOQtA

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPJurAUZE3FKuDINKbFW2vPywsUPL-lL7XxfqcurdNucZzeHmB07JW9ifOoQb7mjdBtZq4ttjs1WCZ3jjiHW2kYd1aPi&google_hm=Z9FKLINTyqyJmLP3brOQtA
pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BE68
Redirect Chain

https://id.rlcdn.com/466606.gif?cparams=google_push%3DAYg5qPIESBF3ZTjD0SADxN7bhydKySAVlmr3n45DCD1zoxch9sLkkt38Jpf096ld8vLlfSETSSkQdDOu4V7I7IIX3-33QDb8ng&google_gid=CAESENKGleaJ-_Sst6MvNNe7C00&googl...
https://id.rlcdn.com/1000.gif?memo=CK69HBoNCNrxko0GEgUI6AcQAEIASm5nb29nbGVfcHVzaD1BWWc1cVBJRVNCRjNaVGpEMFNBRHhON2JoeWRLeVNBVmxtcjNuNDVEQ0Qxem94Y2g5c0xra3QzOEpwZjA5NmxkOHZMbGZTRVRTU2tRZERPdTRWN0k3SU...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwZkkxWV9uSGpMQ1U5aDFMcWs2NlkzRHF3MDFfTVZ5N3FGaWtfLUJvTmRsQQ==&google_push

170 B
188 B

64ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwZkkxWV9uSGpMQ1U5aDFMcWs2NlkzRHF3MDFfTVZ5N3FGaWtfLUJvTmRsQQ==&google_push

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Mon, 29 Nov 2021 11:26:18 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwZkkxWV9uSGpMQ1U5aDFMcWs2NlkzRHF3MDFfTVZ5N3FGaWtfLUJvTmRsQQ==&google_push
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BE68
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKzlkRe...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPKzlkReCHLmsdtPCkc4QwW4gvoyA_J96X3n7lzhUMXHag3MO1tmC3oD1S5Z6cOL-4...

170 B
188 B

76ms
76ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPKzlkReCHLmsdtPCkc4QwW4gvoyA_J96X3n7lzhUMXHag3MO1tmC3oD1S5Z6cOL-4pt3myysW6oTuuRI8p_vY_hzNyHYg

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPKzlkReCHLmsdtPCkc4QwW4gvoyA_J96X3n7lzhUMXHag3MO1tmC3oD1S5Z6cOL-4pt3myysW6oTuuRI8p_vY_hzNyHYg
pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 29 Nov 2021 11:26:18 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame BE68 43 B
64 B 31ms
24ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEIyjjSwq5cNjKafLMnE_kh8&google_cver=1&google_push=AYg5qPKX55H4vESgI-LaRI6IOvbYXjp2HVuThna86lNuQpoYoLTHjcdYU3R9im48d7cY2f-47KFe0LuhgueVXG8qtGh1_OeQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3766246314&adf=4214349505&pi=t.aa~a.2964928988~rp.2&w=395&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=395x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=1&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280%2C417x280&nras=7&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=4347&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=8&uci=a!8&btvi=6&fsb=1&xpc=lLgdFIHTY6&p=https%3A//blogtuan.info&dtd=80
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: f2ctc92uhskt86l1oq3qe4cnlkgm5c1i

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BE68
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

65ms
65ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLEPw8afo7Si74fYZW0rzP-vuHwiSTKqhHFB6_k5t37z6lW7mvHlUhZKCLFWNedGCkwGehozHcrnJGCuOP4mc-K-yZ4

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLEPw8afo7Si74fYZW0rzP-vuHwiSTKqhHFB6_k5t37z6lW7mvHlUhZKCLFWNedGCkwGehozHcrnJGCuOP4mc-K-yZ4
date: Mon, 29 Nov 2021 11:26:17 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BE68
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEN9X51Eqxhir5O8V1pNqp7A&google_cver=1&google_push=AYg5qPKU2Evg2bmm6U5pBDH9XGHlXF6CU7XvXVyjyhrybKKzoB2DvlHu5hscM0hC0AXv0xizQqG...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQUUQtMjYtSFhB&google_push=AYg5qPKU2Evg2bmm6U5pBDH9XGHlXF6CU7XvXVyjyhrybKKzoB2DvlHu5hscM0hC0AXv0xizQqGzK4j9NFlQMmPd8oPl-xhK

170 B
188 B

74ms
74ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQUUQtMjYtSFhB&google_push=AYg5qPKU2Evg2bmm6U5pBDH9XGHlXF6CU7XvXVyjyhrybKKzoB2DvlHu5hscM0hC0AXv0xizQqGzK4j9NFlQMmPd8oPl-xhK

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVQUUQtMjYtSFhB&google_push=AYg5qPKU2Evg2bmm6U5pBDH9XGHlXF6CU7XvXVyjyhrybKKzoB2DvlHu5hscM0hC0AXv0xizQqGzK4j9NFlQMmPd8oPl-xhK
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame BE68
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_cver=1&google_gid=CAESEL16oT4gS2PjQCSgVHIQwaA&google_push=AYg5qPLIc2YFej_5Od0Z_QlU8opmMQ7WMdDuA...

0
0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame BE68 0
12 B 72ms
65ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ls5jwq76MMHUggyuxqEoFWyOZgNSl68hFvdHlpBSTD5Jt_ty7tA7qIYVWQ2vBTuZukxUfe

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/8471840434767868167/ Frame E5C0 11 KB
11 KB 41ms
39ms Image
image/jpeg 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8471840434767868167/downsize_200k_v1?w=400&h=209

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ecd4a06eb7fdf724921d7abc21a758e573c4b8e4c8f3d527ab20772bd8d949d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 28 Nov 2021 21:16:34 GMT
x-content-type-options: nosniff
age: 50984
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11464
x-xss-protection: 0
last-modified: Tue, 22 Jun 2021 14:55:24 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 28 Nov 2022 21:16:34 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/12305365288729292720/ Frame E5C0 581 B
615 B 39ms
38ms Image
image/png 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12305365288729292720/downsize_200k_v1?w=100&h=100

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ec60aac5a1b13c6a47c6885325322945d155b7ab499b3b850e45f8cd92a85a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 15:36:40 GMT
x-content-type-options: nosniff
age: 416978
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 581
x-xss-protection: 0
last-modified: Thu, 03 Dec 2020 17:24:45 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 24 Nov 2022 15:36:40 GMT

GET
H2 200 eum.min.js Show response
eum.instana.io/ Frame FDA4 24 KB
9 KB 67ms
22ms Script
application/javascript 2606:4700::6810:cc16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://eum.instana.io/eum.min.js
Requested by: Host: singles.parship.de
URL: https://singles.parship.de/static_cms/parship/static/peg_utils/peg_logger/peg_logger.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:cc16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d72fe48350b82bd31bd6c6b8e90811d971f483c9722af13005cb7539a0c0a2fa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:18 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 16 Nov 2021 09:19:31 GMT
server: cloudflare
age: 553974
etag: -1517129700--gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=604800, stale-while-revalidate=2678400, stale-if-error=2678400
cf-ray: 6b5b7af79bb24dfa-FRA
via: 1.1 google

GET
H2 200 nvi Show response
singles.parship.de/nocache/ Frame FDA4 15 B
382 B 63ms
60ms XHR
application/json 2606:4700::6813:ba79
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://singles.parship.de/nocache/nvi?url_path=%2Flp%2Fv00%2F6%2FU%2Fhtlp%2Findex2.html&pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID&ref=https%3A%2F%2Ff102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com%2F

Requested by

Host: singles.parship.de
URL: https://singles.parship.de/static_cms/parship/static/peg_utils/tracking/pegtracking_combined.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:ba79 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92f75b3d52eb22fd4d5af5352dc0bb43e5d0bc979f274783e7cd17884221b72e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:18 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000
content-type: application/json
cf-ray: 6b5b7af75eb91f2d-FRA
content-length: 15

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 49DD 35 KB
13 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16694
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 9B42 35 KB
13 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16694
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H/1.1 200
OK viewability Show response
hal90002.redintelligence.net/ Frame 61B6 0
150 B 39ms
15ms Script
text/html 46.4.10.47
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90002.redintelligence.net/viewability?s=94786400065214000757623011793002&a=ef178808&vb=m
Requested by: Host: hal90002.redintelligence.net
URL: https://hal90002.redintelligence.net/request_content.php?s=94786400065214000757623011793002&a=6c7cc0db
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 46.4.10.47 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.47.10.4.46.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal90002.redintelligence.net/request_content.php?s=94786400065214000757623011793002&a=6c7cc0db
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:18 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 _210422_ALDITALKSiegel_DISQ_neueVersion.png
s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/ Frame 8311 10 KB
10 KB 37ms
37ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/_210422_ALDITALKSiegel_DISQ_neueVersion.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=324791772&adf=2448070778&pi=t.aa~a.2318699947~rp.3&w=417&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=417x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280%2C379x280%2C417x280%2C383x280&nras=6&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=937&ady=4023&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=5&fsb=1&xpc=c4GayY1X6E&p=https%3A//blogtuan.info&dtd=78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bfad6b2faaf303b104a4249c2579bebec6b87c681c274e95dfc05700f4bbfc64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 23:00:33 GMT
x-content-type-options: nosniff
age: 390345
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10628
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:10:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Nov 2022 23:00:33 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7465 0
23 B 125ms
76ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv3EdwiI2Hw2iScFuMi83BJZ8XseNu4_KkSaszXVOat5cH-Fn3acoKFwewONIAoBwPCVij5RG60LsrdNVo_P0A4XzzeM5ohYrUQHNhbWE0hcIREpwLN84xGYXar8MZ6uC1L6A9hHeMeH7zZB2zM2ac4T9OAQBiSHPx2Qj6r-oZCu2viGVwUR61tMf782dhLPxAfYLJ-Wu5QBYo86WNmhhEFOhQFmzfQq4zlpK1XqOxuw77eDqFuemz_zJyRuTCglN26vjDMPPduXY4ExuZ2Re5x4WX4mZiISigR5gT_VV8aZGPa8lf1GSq2ishYC7zadeTmZpajVcUvH3QQWCv_a-ypbDUACA3POEBYelqhM_0-tSWbO3ln-SfooS3mHBV2XxLPT1sMhcO3EtiukjrLiIshyyVt81MnpbgJ9lG-YlsZPuQIwZDgga9qqbA2ZRvfg9UcxTVSp-yH4q4swPx8s8jrRQwL6fXy9wViCWJ8vf3TLeSFKczABs3I28mFtsMGCjc8hOa7bCquiZvQuk-VRFyYmQrxWp3I58_W23u3hO_u3m5EuaR6YMFKWhZys1BcCQxUrq1uhiaIT38p0ya5otswtqTlSK8bgy9_OdZSk5Ji_CJfDOqwzcRZsG4ybijWX6U_CLl2TaLfOb52DyK3GzhbddHd-MuM4qwy6Cv_ekJU8EiPjw06zkpuxkxmeHxwB8fhDmlFgB-tfWx33Hi01jc1XWK0yIF_5SS5cnqkp_7Z-U2JJkuVTDOYLFPhRJNGHdFOzhSsu2vqFEyxc3m3-VPHMM36uHYJkpUmUHXvVwkq-Vvl-2H9CnEhLbyWMB66Q-0Ptf-JlIGROVwLZe0fgknjRocUwkOAolOLM6XoUoNp5iO_5mkZW80fjc9vni9p0KSFOdDOS2X510ppmtLcEcrA8S1Suikg2Dtpu2903EUu6j-0tV8cowZuz3YofP5-g5QGEFIRcN_Wi4EVu_xKmQkJC-XMSjAwPCYhD2WfYdMkVAOXxhZg28KOeZ4gsed86I0gXYzjF9vHRxH9h8SPtbTLOwewWxHi1pCYg6g3ZjVix1KxVfk_XRqkFmbdkhst0KS9XrJj3ihE4rtUPgmpvHXBOPVY6w7Pe_1FJKPiDc8yM-pR5QC6XlaeTIq-lsWazV6QbAbuNnL9Ztm2Z3poowqK&sai=AMfl-YQL5Z0Bu1ugZC7Dx_J5TH3n71BitXKZwvqvqfmqjZ6o2GbmkjvhH5pfNtjrLLo6RmT8GDTOHFO_Sl7UGfgrKs3EIRBZGstKbSZBK-COdJ4ASlyfgX7HfLVjjON-t5vKwL0Cqdap4eUxS1ra35TVnoU3T6G7DZrytx4zly38Zn098vJLS7DvERjhu76wjyIquoMgm_RJLFAAQEh9sH4OWevSr2ryDmcf5scqbuQeXjNLVmRgUqul7E8LGx4-uPbpOc848c1CYMKiRjfVd-yTyvazGStauypE2WHDbx_ftPJn&sig=Cg0ArKJSzEgdzR7Vs0n4EAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=682&vt=11&dtpt=316&dett=3&cstd=364&cisv=r20211111.79952&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 37B4 0
23 B 97ms
75ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvd06aebIewDmJA8Tqcv6IfcbCew12BuX_rgt2SsYEb6LD6zl8tJY0Q8WS6XUeKCri2P103onbQc4M9I_QTA7fAznRKRn4gM4K0v9wgYaS_71hhuI-FO7U3umrkaCluCNr0eIOlxm5wuODubzu3r42yNBdxlA9cwQzS56oaLQroL4HgJulmEeylAFVkaKXHxVzT-l_QRf0PXk-bDR_ytBnOjkmxl9vW5zZHb0xKn__LWfnzFqC4_D8L29H4g61r8IifMdBgnFhMLjgkxT6pX6HQUAMPglTbNpPJL-WK6LwtkIi7aeMhm0EJT0WqblaJizJXAT7cMmD47AQLQmC9okPE-Xn0XmZN2fI30jjxSkPFhcxuj6EZj3ATxLhgjw1CqPC5_d0FUky0rlzIUYywyGWMxKBvmGFEQusgJwi6Acz8pVHjDNokm4fG4vyw5y2iLaKx-QclW-6QGvLwlNTagRawMIQxpzgQQejmpmo2G9CUpS3JyaXrJOwLHCgX4GLVwu3XrvlT_55CJeWOd69UzvO9CEJ13Awtbchjuc-JN3keJRjckDE1O-bnoKgsASEOfdzRPiXDTxef7r3RoOIaATpY_c1aUv-HGKr3ekvE6M6F_rFGphlqmvYiZjKijGuFn8QxlH9XccRC_uhHE07IIKKFHiWdXULCNfk8bPIzVzg3XG2jg0HLW2eb8enKR0TRwVzOLTXqMuc2Up0gg6uby2GUO5TkwkrO7cqACDgrD78h_eo2MsFH9hmpAT1_hcfnjSNHJYhZXNii4v_e_YwoBt28Xg5AjU4FEmZT5hZHUMAiuhWpsblMnfrYbM-jItXsCHAzmc_RqsRZzlkORRjRTFrItrS1_yfpcrjH3gqr_EgupotrdzVmZn-A6TSnu5oyJZEuaod72BFAP8yAtAkgzfPVLZRQEt_vXMq2sbSKKOLksZp58ZBvXWjBTO-hLB8-BgigS5xCk-djn8cHAUWg1o_b8FXwS1qk94VMnLvNiZEXlMinUmI9Enh-_QeDWiAT9TnP8BGGrrAKe1XOKrfWPX7BhnYCRYzR3USgqkc2qDyIGl9QIOHxufn4keE1yShvDjdjVyAXX5dLyF0C_eqGD21MY-tbwrW63GKTpmcouj0neToCu7g_I12UTWHsoOnqHfffyowAFiiQLM7knkQ5I69yC2dsia96YXyNpXWPBmx9aVizZqzeJwC2imPdWg&sai=AMfl-YR6FBfnNNqY3iu4MU6u9LilZxBMGyrMwmskqEUfG9-E_ylm2pEU3b4C43Hkq70bxYIV2hlPp445JVCPczPXPnVwM4NR1Fr4EjN7DU4uX-4pXZKadaZ1Fc75G4yH8nwb_XiMcle6Mw7-zzDFMoR_7UEZKwlhWQ&sig=Cg0ArKJSzDe793s6FwRWEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=816&vt=11&dtpt=351&dett=3&cstd=459&cisv=r20211111.81707&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Aldi_NORD2x.png
s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/ Frame 8311 3 KB
3 KB 39ms
38ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/Aldi_NORD2x.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bbfe8230161b4ec8b7ebf7872269f7865940f8c7bde022475b95feb3772e292

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 23:00:33 GMT
x-content-type-options: nosniff
age: 390345
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3199
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:10:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Nov 2022 23:00:33 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AD5F 0
22 B 74ms
73ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BzLFQ2bikYfj7HoKH7_UPqteWyAwAAAAAOAHgBAI&bg=!KimlKW3NAAZQLpa_UC47ACkAdvg8WnfLIkwxWJS4123lCQhaElNYbt1GrYW6NLVLsb6HQdndDrqy0AIAAAJVUgAAAE9oAQeZAtj4enGFW7P7IIRhUCgfxGV52doKeMBMikzi31oqKgkB1HnFWQtDIqYeVoe56HW1qxtnbqOlyVmtn1ZnO0a6Dr1aXCdnIyy3t80cSYWH_MdOIThpiE44RftGatwGR6a0UDbmihWtCtYiJ53JM6Vy5BQ5cHpTMJf8fYrU640aSLwn8oBheG5LejHp_CM3BGStYIKIfUqeHeJC6714MA0oHvDZHPrJAZoZ8W3yibriBqNs7l2oWKP0ObG0owwd6NHaDtpTn2KIsb67g7hIPJdN_c_x4ZjV0LNN3PR459odYVBJd5PjRalAfVVToooxXmT_MbqysISgI9DrYB8cXZFYDOxkHzQ654V1abWaXwbGVpr6tw1esINWZAp6zYsZc4HVORhYSSt0LwGE8EiXnUe_21y2MeGog1Y42iY-KgS4r0JZjG2R5pYzZeN7vfHclUMLUddfkHO7OC66ruLpqept9B_r-gqn5dW_RkWCSY205strkYMCiEjzJIVqElwisgPM-fSlk6VSVesTnbEmq6iHxGS75YNaQDcbOlYtZPp_5IXr1ujXMTya6aWgYq4l6I9YGaxuD2DGS7Pfs_Fptv7Y21qTKWbQY7M2wQ_5_YlpfayCuTHWuqASb0cdo1Q9M8Ix_fcLcpjdCRMEkgD_EiTggtGC62AyNuhDutINf172xSQQ6LPImwhMyriyEsmiOGm72WWU-reYux-Cs6XTcs2nKw-At1Eirod0EmuvOxw_cYECkAagWlo1ov791l1VZN-6Sl6zwlLxIIYUkg0AWdBWb1OHWam3J-OvOO6vQt59hKRQ6lZ6Gtc9RwYaYgWKtGmrKjzG1TXPlStbi_QfdU-BAgCTVbHYqk_FBmfqSpbo7-M7UhWLPe6lvCNu8Y_yo0tA5c1qsh8QdPqN8sPYKTlOEamSqHZkpwcf1LGxIhcZ-l1TgOJMpwbdThSafyYf_kqb1P55pFMWFA5_PQ

Requested by

Host: f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
URL: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Aldi_SUED2x.png
s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/ Frame 8311 12 KB
12 KB 46ms
44ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/Aldi_SUED2x.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c4b77b6214183c17cc86a95a77074d19adf0f18c1acdc135104cb9323b0f4833

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 23:00:33 GMT
x-content-type-options: nosniff
age: 390346
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11876
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:10:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Nov 2022 23:00:33 GMT

POST
H/1.1 200
OK bsevent.gif
tps611.doubleverify.com/ Frame 21DA 807 B
1 KB 288ms
88ms Ping
image/gif 204.154.111.142
DOUBLE-VERIFY

General

Check archive.org

Show headers Download Go to

Full URL: https://tps611.doubleverify.com/bsevent.gif?impid=ee13c25402024c178fe4189981769303&vfdur=734&cbust=1638185179033870
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal100.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 204.154.111.142 , United States, ASN36062 (DOUBLE-VERIFY, US),
Reverse DNS: nycp-hlb29.doubleverify.com
Software: Microsoft-IIS/8.5 / ASP.NET
Resource Hash: 78fdf5abc0ba7951eb52c6d66c9d1a9f8766f4d1c60ca05173c26623de3f3416

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Pragma: no-cache
Date: Mon, 29 Nov 2021 11:26:18 GMT
Content-Encoding: gzip
Server: Microsoft-IIS/8.5
X-Powered-By: ASP.NET
Vary: Accept-Encoding
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true
Content-Length: 860
Expires: 11/28/2021 11:26:19 AM

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame 21DA 9 KB
4 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal100.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba8e38c6c85b0384447b0174b6e16c72c56acbd084c40db40abedf89036f080c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 10:48:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2242
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4451
x-xss-protection: 0
last-modified: Thu, 21 Oct 2021 15:55:37 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Mon, 29 Nov 2021 11:48:57 GMT

POST
H2 200 rum Show response
singles.parship.de/cdn-cgi/ Frame FDA4 0
236 B 16ms
16ms XHR
text/plain 2606:4700::6813:ba79
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://singles.parship.de/cdn-cgi/rum?

Requested by

Host: eum.instana.io
URL: https://eum.instana.io/eum.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:ba79 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

X-INSTANA-T: f2f36a6a07ff614
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Referer: https://singles.parship.de/lp/v00/6/U/htlp/index2.html?pscode=01_100_60078_1026_0001_0001_empty_AF00ID_GV1638185178.5503284.2bc545f6-5107-11ec-aa17-00155d255900ID
X-INSTANA-S: f2f36a6a07ff614
Accept-Language: de-DE,de;q=0.9
X-INSTANA-L: 1,correlationType=web;correlationId=f2f36a6a07ff614
content-type: application/json

Response headers

date: Mon, 29 Nov 2021 11:26:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://singles.parship.de
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6b5b7af909231f2d-FRA
vary: Origin

GET
H3 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame D92A 47 KB
47 KB 40ms
39ms Font
font/woff2 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:20:32 GMT
x-content-type-options: nosniff
age: 347
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47676
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 29 Nov 2021 11:35:32 GMT

GET
H3 200 OnAir-Regular.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame D92A 47 KB
47 KB 45ms
45ms Font
font/woff2 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Regular.woff2

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c110419995948214e5b16d9d0df8f7d91536cc42783edd90c7fc1810308309ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:18:41 GMT
x-content-type-options: nosniff
age: 458
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47848
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 29 Nov 2021 11:33:41 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame D92A 7 KB
5 KB 51ms
51ms XHR
application/json 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_246&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

71a6d80ed4707ac75d4250493b23a63494e3cac5435d94c4080a1471750d791f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5130
x-xss-protection: 0

GET
H3 200 60005582_20180201040701083_empty.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame D92A 95 B
121 B 64ms
64ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20180201040701083_empty.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:07:59 GMT
x-content-type-options: nosniff
age: 1100
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
last-modified: Thu, 01 Feb 2018 12:07:01 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 30 Nov 2021 11:07:59 GMT

GET
H3 200 60005582_20211014235342828_APP_iPhone-13-Pro-Max_Asset.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame D92A 26 KB
26 KB 64ms
64ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20211014235342828_APP_iPhone-13-Pro-Max_Asset.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

94c861b3e4bc918650205113892b86d7768e0fbc75fdfcd8e103e87988eea6aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17817395587843096576/300x250.html?e=69&leftOffset=0&topOffset=0&c=r0nXpiOffT&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Sun, 28 Nov 2021 20:08:06 GMT
x-content-type-options: nosniff
age: 55093
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26950
x-xss-protection: 0
last-modified: Fri, 15 Oct 2021 06:53:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 29 Nov 2021 20:08:06 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame D92A 43 B
609 B 34ms
9ms Image
image/gif 82.113.101.132
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14112_PV&mediacode=25667676_4307561_303197282_146334235_-0&ref=25667676_4307561_303197282_146334235_-0
Requested by: Host: blogtuan.info
URL: https://blogtuan.info/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.132 Offenbach, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.o2online.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:19 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H3 200 L.png
s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/ Frame 8311 18 KB
18 KB 37ms
37ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/L.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

857b0f1b0bb1cb2a934a6133f58b63ad67e9c38ce86ded4bacf744942af391b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 23:00:34 GMT
x-content-type-options: nosniff
age: 390345
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18357
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:10:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Nov 2022 23:00:34 GMT

GET
H3 200 impl_v81.js Show response
www.googletagservices.com/dcm/ Frame 21DA 41 KB
17 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v81.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3be6ad457ba5d4425f4d105688e9cf5a32595ff156bd290c8ccbe0e6ca3a68a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 08:13:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 270754
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17189
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 20:08:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 26 Nov 2022 08:13:45 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame D92A 17 KB
6 KB 77ms
77ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_246.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Mon, 29 Nov 2021 11:26:19 GMT

GET
H3 200 S.png
s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/ Frame 8311 18 KB
18 KB 38ms
37ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/S.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc5556014253064c07afe28b305ed6ffb4f0d0ce78277ccb218af38109a1bf47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 23:00:34 GMT
x-content-type-options: nosniff
age: 390345
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18668
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:10:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Nov 2022 23:00:34 GMT

GET
H2 200 B9689862.280410797;dc_ver=81.235;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=1726166439;ord=f8ysq1;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=2,https%... Show response
ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/ Frame 21DA 45 KB
22 KB 160ms
74ms Script
text/javascript 142.250.186.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=81.235;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=1726166439;ord=f8ysq1;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=2,https%3A%2F%2Fblogtuan.info%2F$0;xdt=1;crlt=CeKTTc5oii;sttr=89;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v81.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f6.1e100.net

Software

cafe /

Resource Hash

7038b361d556839ebf915c2824bcfb171e829d2e15d20d073770db2e3b582c59

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22293
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js Show response
pagead2.googlesyndication.com/bg/ Frame 79B9 35 KB
13 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/CRtE2hXI-Oo2CzbqEvynNThBTGvKRH_6so9ly1Scye0.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

091b44da15c8f8ea360b36ea12fca73538414c6bca447ffab28f65cb549cc9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 06:48:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16695
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13332
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 29 Nov 2022 06:48:04 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 49DD 0
22 B 74ms
74ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BgIKe2bikYflcjZxv4O6kwAwAAAAAOAHgBAI&bg=!z8ylzIjNAAZQLpa_UC47ACkAdvg8WheXWQowVjY1U7Zt8zpR6ZfpLY6LJOB8LhTBcXyqFZd1yDzP0gIAAAEDUgAAACFoAQcKAKpCldnecvNFQA_9kLeKgAGfSYjN99p7XfSkckkZqkTAb7n9PPtwLkY9if4ZIJoG1QNGhCswZiq_Tvuy5lgJTh_zIOTIUFm1ntG4hn6wRZokwwgFABfz2qP6dMd2dQoqksxCaE4hAdAiMVz2n2mLxiCjXUmMo7oo_HC4tIxaIG7qDR4cbESYBvSHXeB4RAZVqg2P9N8I-PcydhfTkvQHzfP6gM9IGrfbZJHS8JkCw8ocCY4ZWFwI3lM99jC3Oq9chK1-PaG8PRKl4nB1s7vnlttSB9ecVVwKRQ9k6zyvta-dmI443KNT_6QbhKUOgPjZwp1akmGuqnhZv-YNL2ryyb0Te9VrCaDctbLVDALAXZ5zJbxQcyLbs7Uyn-eWej0z1mgfgT23BOVm3Esaf99_pxeCRLrLIoO6n92GLX-xtSCjTkeeVCG2ltDjCiXcHlfjYs0a6wRLYt24McWaDCNrEA3z4q8XkzVRbGVYN7XgBqydZXemqb4QeH-xcm2pxyaGg9XKpDd7fLFfKuxque5-VnSNLxOtDhb6pmfYZka6rg3ChsrPiu0m3xJmImunMR6Vi3cOrmZF8Y7g1O7wr6YU_BMIYA1U0JmAxsFf148TS5ItakBqNMlopzyqABAzktpzGorokoUzl7diWamDAF3e908_q-MkqntCNlbvEKIpzqTt_azZcGKsxpjJ1VwakY2lUVxHRyyL8B7L9kcNA99pCpRG6fPIbgufprinbIzxNr_EicPfoiOJPXTxwHKlKXT8LD6Kf24anmbMztm3PDYUA69zkMqIxMrC-jqlIjqKTNKuX3JcHMNlOoywpJmy0acZdGy3790Mrmo92iOwqzz-a_i8nEa5tvpgtw1aVthE9tdfrxcpzw3BV_P5noU2SYYvcwrO7RkF19ExGWQ7g6UgyNR0LYr1puvrd_W2wUTnQYL_JYzy9Q-1qUHSOvW-0wW-w33OCfD1kBp8kr-DXSNuJW-0FJuFNVES5MUNZFuPhev2KCYH53kyOvthFzqkEGJw8YjhWc6xWeGb6AxJ0ETWRXD_lQNKUt-4U9wGOVBtHDnrbeK9JNcIRVoLpFtE1kF2OhWMTCMOujUBH11jinml1kN5QEYxZrHjf8OvpwdZ4p6S40ah5aL8PZ7vzveItjInO_KmTy9TPl1YGZXdaAG9skdn

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Talk_Logo.png
s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/ Frame 8311 3 KB
3 KB 37ms
37ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/Talk_Logo.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

400fe79399099ea15ff9e2b9a10c983ecc76d497c58cce9cd7b1ab3171246f8b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 23:00:34 GMT
x-content-type-options: nosniff
age: 390345
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3046
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:10:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Nov 2022 23:00:34 GMT

POST
H/1.1 200
OK trk.php Show response
action.metaffiliation.com/ Frame 462C 817 B
3 KB 81ms
26ms Fetch
application/json 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to

Full URL: https://action.metaffiliation.com/trk.php
Requested by: Host: img.metaffiliation.com
URL: https://img.metaffiliation.com/na/na/res/trk/script.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash: e6a58245d63dd53e24db5dee09f410b84ea78e50e6c74977ee04f9f36acb2104

Request headers

x-kwanko-sdk-version: web-1.16
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
x-kwanko-content-type: application/json
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarypofKFFL6ZXittekP

Response headers

Date: Mon, 29 Nov 2021 11:26:19 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP="NOI DSP COR CUR ADMa PSAa OUR IND NAV COM",policyref="http://www.netaffiliation.com/w3c/p3p.xml"
X-TRK-D: 0.0052449703216553
Connection: close
Pragma: no-cache
X-TRK-PROC: 73241
Last-Modified: Mon, 29 Nov 2021 11:26:19 GMT
Server: nginx
X-TRK-DECISION: 2
Vary: Accept-Encoding
Content-Type: application/json
Access-Control-Allow-Origin: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
X-TRK-SRV: 9

OPTIONS
H/1.1 204
No Content trk.php
action.metaffiliation.com/ Frame 0
0 77ms
22ms Preflight
text/plain 95.131.136.1
OXALIDE

General

Check archive.org

Show headers Download Go to

Full URL: https://action.metaffiliation.com/trk.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 95.131.136.1 , France, ASN47841 (OXALIDE, FR),
Reverse DNS: front.netaffiliation.net
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: x-kwanko-content-type,x-kwanko-sdk-version
Origin: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

Server: nginx
Date: Mon, 29 Nov 2021 11:26:19 GMT
Content-Type: text/plain charset=UTF-8
Content-Length: 0
Connection: close
Access-Control-Allow-Origin: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,X-Kwanko-Content-Type,X-Kwanko-Sdk-Version,X-KWKunijs-Debug,X-KWKunijs-Version
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Max-Age: 1728000

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4D6C 0
22 B 74ms
74ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BHXnQ2bikYfyoM4ik3gPZw5n4AwAAAAA4AeAEAg&bg=!JySlJGDNAAZQLpa_UC47ACkAdvg8WuOCmNno2D4NjcVJuwdne40ELTr04LoC6LnWy0snrdgSassDEwIAAAFTUgAAABBoAQeZAskNPEQbi69lYqrr1-zSfxFg6v4WZX9OZNRxqh__TFU-bdm1Qy9P03dYTdO8F8L9U1laB0dcn_2PEg6D4ku18ODfdFUq81SibtIzk1yDFEJVv1rZ3d5ZFWnqQC5fyq7ks1fUx0EMIwJZLk6S8iIxiaYt8vNu-bRWk0be3UbCrUGWHJMUBvCCC3fFcBHqg7O-VxRTnIdMMUpx-e07htGyKdG34LmcUSozmgMlXsSKESUh8-rP5ndGLZRCOMhB6PxjqRPdxusXgg2Ft0y4G3urbdmbaawuRUrnrZDMwweEA4OS75lmTJiFLk7MlAI-sIoRL9QPCaEI5kqGuJiLUelK5NgwnKQSGJvpIN-qt-MY230CXkMfgLW43NxR4XmXOLiIPZVaBvyZTTym4mmFVjuCLbYq1c2R_zu_nngZr3nbRp7BCWnYBdcqozwCIW26K8AN6gF_Ota4FFNwglrj64xnrAOelJ8XiwOpXxq_WGqZsQ2GU-Ao9tIlkC-R39lAC8x2Ri38GPRyetNPLLIPF4DGHvd73u6s7WaxGKJXSJKxbIJVLbI7rPuJjL8M0wnegRHqAsOnb7O162tCb65OuW0hzY5ofOxtVpL8x84ox8ok4d4IF2et0kRiHV-dYq4A4Qhmr0Cf1BOICdJ8mW1EC7lTMbuexhjlPkdTU9Q6J5mGyXMcZuzNsPGqPmOP7uYhwnXTvmqwQpQsfY_gR5bjtX1k3UeBVZJsQsTT6ClTqKoAVm-mDKXpv2ansCMgQNvpx67_g_Bj9pXyhy9NISGkIyCIYH2U05RRT-3cFXpGRK1rV5I8cXTKaK8ho0Xmc-frqypeuVn2BEEg7VQMOyKCkbl06a2l_fgCb9Kdx0A-kkLJFjKRx7I5JqACrrHJEPpvMDrQKMYWPlUOdJJcnBHVIDHD-nz2w17MqI6SaIfOJZLxWSU_7_GT4j2xZv6cGg

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B441 0
22 B 74ms
74ms Image
image/gif 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BXVLs2bikYcHWOdfw7gP95o_IDwAAAAA4AeAEAg&bg=!ICOlI2fNAAZQLpa_UC47ACkAdvg8WjJkHnfRSITUYK-6wGOIdVHaYDm5XOo9xAgPch3b7mpECn-FBQIAAAF0UgAAABBoAQcKACgtM3SttR7gYEt2wAun3EzfROr9GGWfEQ3pdb7STxQZsnNniKzroN8umQLJin4r50-QmJjtXFf8M_uiW7CpxI3oJxY6b-ftSEun0QCjgKe-B_U_rbNk114bKo1lTk4E0NpwuG_xbSqMggBl33rpru-tAHaW9vEFvDnydMpXT3A3AjAW_A_bJehK3a4AEOR2oAypNLAAvdn6rbLLx0d1uwePAC9cA4YztNkdRIOE8fhWyMzw6DNE66eCIvG6KZF9PqIIbaEP4LZ3QkvB2jL-SPqSVSa0O6sVC7eXRi-rnxzu7frCscplgcIH_uh8M0nWqTrpmRF_2ZpiCDQvohTITr0qEjsZfYDkemg1uk82GO-ZCv8KTZQkXuToug-U6szaidGAbF0weZ757zGy5iRRp0rF0T1lqadl6VRJCE8Byw80m4c79mCq0q1WGrawCQaiM3meaCFMPxCM6Nabesk-t-6Qz7cV46tMrcKpa_nTNrA2QTT8I6x3Ii3vATR0OR13cP1FikhqBPb7Pdm5I-imVdO9hg33VM_hF8MLMidwZuRr-MNp0pTTmerRVI4ibixSZlHivMZxM9hQ2_nOtIGr4kUO2Sw8d3Pnv7e6MzFZezQER23hHkS8T8h-ILwMzBgN8nidjHLgvdX2PLlzMnf4x6SgLRKCMNuMdU1lqUrxcRhi8A6FQHZr511lNHUTMV1xRoeTB87qj1zIZZeMOXP3Bltlit4v72H1zMI4EV5iLqbMZcasBCrJ7mx3iytSBiRYUw2b1qqi94vxuADwGCZgYTkzFIw389sLDtmEiuopmgXj6Q8d4ay8PaD_5flMMWz_rifYmC254XlxeDj7lTjUAh2Cjft1nXivXi0puDFH9KLybAgEPnN1sangl3cPJtScXAWLjeD8AopbviOK308omuWQQDQ9cN4U43KRLUVcMmn4iK3ou6w6RhMZH1UXFtT0StkWmHsV18lkF9Ur5uItNfuWS8Y-H9rxISWuMdRS_skQJ9THnoY

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 XS.png
s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/ Frame 8311 17 KB
17 KB 37ms
37ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/XS.png

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

43dcce97d7a66e07e87258fb668ba751e6f6e0f15afb48d171078a6ea449adfa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/9965978905776748879/JP_300x250/300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Wed, 24 Nov 2021 23:00:34 GMT
x-content-type-options: nosniff
age: 390345
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17391
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 14:10:19 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 24 Nov 2022 23:00:34 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 21DA 8 KB
3 KB 40ms
40ms Script
text/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=81.235;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=1726166439;ord=f8ysq1;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=2,https%3A%2F%2Fblogtuan.info%2F$0;xdt=1;crlt=CeKTTc5oii;sttr=89;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:23:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 142
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 13 Dec 2021 11:23:57 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 21DA 0
23 B 75ms
74ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu1t29f3z61VOND37ig-eQrPhtDMUJFYb0lZ3GRpcac1bMPynIBRUXu5uxuOHRG98j4_86uuZgzQmFs7eDSoYvdi4XD8x4QZe4SBOubr7OCymwpE7dVkb265J_kgRVnqmU8QPZdKycKaQ9uH__Z_g&sig=Cg0ArKJSzFkFtTCyWLmmEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20211111.58948&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:19 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK dvtp_src.js Show response
cdn.doubleverify.com/ Frame 21DA 8 KB
4 KB 21ms
21ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvtp_src.js?ctx=13311291&cmp=9689862&sid=2641434&plc=280410797&num=&adid=&advid=2276943&adsrv=1&btreg=505290178&btadsrv=doubleclick&crt=156804364&crtname=&chnl=&unit=&pid=&uid=&tagtype=&dvtagver=6.1.src
Requested by: Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280410797;dc_ver=81.235;dc_eid=40004000;sz=300x250;u_sd=1;dc_adk=1726166439;ord=f8ysq1;uach=%5B%22%22%2C%22%22%2C%22%22%2C%22%22%2C%22%22%2C%5B%5D%2Cnull%2Cnull%2C%22%22%5D;dc_rfl=2,https%3A%2F%2Fblogtuan.info%2F$0;xdt=1;crlt=CeKTTc5oii;sttr=89;prcl=s
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 8b94cbe5296254e6bc2199c7099b21f9308583e421f3b5204166eb9bbf19cc58

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:19 GMT
Content-Encoding: gzip
Last-Modified: Thu, 25 Nov 2021 12:39:48 GMT
Server: Microsoft-IIS/10.0
ETag: "0424488f9e1d71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3291

GET
H3 200 10607475269319393041
s0.2mdn.net/simgad/ Frame 21DA 64 KB
64 KB 38ms
38ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10607475269319393041

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

735e8910e491da560ea18efe17fcb8b50452f21975692ccf984ccf8fa2223793

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Fri, 26 Nov 2021 06:27:27 GMT
x-content-type-options: nosniff
age: 277132
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65242
x-xss-protection: 0
last-modified: Tue, 07 Sep 2021 22:08:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 26 Nov 2022 06:27:27 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BB68 1 KB
752 B 39ms
38ms Document
text/html 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sun, 28 Nov 2021 13:26:12 GMT
expires: Mon, 29 Nov 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 79207
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 21DA 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99679e924ccd6d1b28cc208dbdb6d919728a56b83d12e68ea17b50e0c878f046

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 42F8 22 KB
8 KB 37ms
36ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 24 Nov 2021 12:48:37 GMT
expires: Thu, 24 Nov 2022 12:48:37 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 427062
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 462C 43 B
947 B 33ms
14ms Image
image/gif 85.14.248.72
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvId=8&extPu=esprit-dcm&extLi=25444971&extPm=319075961&extCr=&rnd=%n&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_312}

Requested by

Host: blogtuan.info
URL: https://blogtuan.info/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

85.14.248.72 Kamp-Lintfort, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mo, 29 Nov 2021 11:26:19 GMT
Server: Microsoft-IIS/8.5
Date: Mon, 29 Nov 2021 11:26:18 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 1788
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 21DA 0
23 B 73ms
73ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Mon, 29 Nov 2021 11:26:19 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 img_5_1_3.gif
img.metaffiliation.com/12/73241/ Frame 462C 8 KB
8 KB 15ms
15ms Image
image/gif 192.229.220.129
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://img.metaffiliation.com/12/73241/img_5_1_3.gif
Requested by: Host: blogtuan.info
URL: https://blogtuan.info/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 192.229.220.129 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (muc/3365) /
Resource Hash: 3bbb519ea3973bcaf68f99c494c76e520d223cbea4c1ca039d88cff8a34445d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://f102004d3e2701a7c75fe5b6c1ea737d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

date: Mon, 29 Nov 2021 11:26:19 GMT
content-encoding: gzip
last-modified: Fri, 26 Nov 2021 15:35:55 GMT
server: ECAcc (muc/3365)
age: 1529
etag: "61a0fedb-1f1e"
vary: Accept-Encoding
x-cache: HIT
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=600, s-maxage=3600
accept-ranges: bytes
content-length: 7665

GET
H/1.1 200
OK dv-measurements1874.js Show response
cdn.doubleverify.com/ Frame D5B3 490 KB
89 KB 17ms
17ms Script
application/javascript 2a02:26f0:6c00:2b2::4469
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dv-measurements1874.js
Requested by: Host: blogtuan.info
URL: https://blogtuan.info/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:2b2::4469 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Microsoft-IIS/10.0 /
Resource Hash: 9d37d1712b2be6bd01460ea30ab676c8baa512d5f1de5d608511a4403bea72dc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

Date: Mon, 29 Nov 2021 11:26:19 GMT
Content-Encoding: gzip
Last-Modified: Tue, 16 Nov 2021 11:10:53 GMT
Server: Microsoft-IIS/10.0
ETag: "801ca49edadad71:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=946080900
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 91038

GET
H2 200 dpixel
cms.quantserve.com/ Frame BB68 35 B
210 B 9ms
8ms Image
image/gif 2620:116:800d:21:fcb8:22d2:d390:5f1b
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENW1jxNXIMBZp3JteUPTZlU&google_cver=1&google_push=AYg5qPJOI66w-kfMKRphmxm68dvo9KauKJQD_K5n3ucUf2N3F80qtjBvh-dMf1iJ60C-6dhOTD9LUvwIWKeUAZRDz4CeFaMGikk

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:fcb8:22d2:d390:5f1b , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BB68
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPJBjQ5-...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPJBjQ5-hNlqO51QDUl10nTxZKSQA5hMIXax35uKt7E8bCnTeU7YPuP2l2SM1tfR4_...

170 B
188 B

63ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPJBjQ5-hNlqO51QDUl10nTxZKSQA5hMIXax35uKt7E8bCnTeU7YPuP2l2SM1tfR4_BpQoHsMHqQISlbe4JV1USnzEFRq6o

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMTExMjkxMTI2MTgwMDAxNjg1MDU4Nzg5OA%3D%3D&google_push=AYg5qPJBjQ5-hNlqO51QDUl10nTxZKSQA5hMIXax35uKt7E8bCnTeU7YPuP2l2SM1tfR4_BpQoHsMHqQISlbe4JV1USnzEFRq6o
pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Mon, 29 Nov 2021 11:26:19 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame BB68 43 B
64 B 22ms
21ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEMc2Yltlgg4WhIGRECdfC7Q&google_cver=1&google_push=AYg5qPLMS5HkHo2hnbA0iJXsI-DhjEBDQQJ42dyM9KhfNOPgmpwXXkq5Tl_fX4CGZSZQRR2jjgp6HdAUDcQyqNF8Fe4dajItX8w
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6082226082793588&output=html&h=280&adk=3149249042&adf=2279666065&pi=t.aa~a.2964750914~rp.2&w=379&fwrn=4&fwrnh=100&lmt=1638185176&rafmt=1&to=qs&pwprc=7132603035&psa=0&format=379x280&url=https%3A%2F%2Fblogtuan.info%2F&flash=0&host=ca-host-pub-2644536267352236&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1638185176892&bpp=1&bdt=1542&idt=-M&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D9acf56ab3980e218-22c2c9e512cc0019%3AT%3D1638185176%3ART%3D1638185176%3AS%3DALNI_MZWpspD1QJ65OGH1E_NVuojGMHbbg&prev_fmts=0x0%2C770x280%2C390x280&nras=3&correlator=2909481184534&frm=20&pv=1&ga_vid=1159209771.1638185176&ga_sid=1638185176&ga_hid=652958358&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=246&ady=2790&biw=1600&bih=1200&scr_x=0&scr_y=0&oid=2&pvsid=3391664811581826&pem=779&tmod=1470304247&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=2&fsb=1&xpc=tpYqTUWWo1&p=https%3A//blogtuan.info&dtd=68
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:18 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: eqopu9fve9la9gnn49it7olcifr5p01k

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BB68
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

63ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIObgmEXzgokEQi37CA5EaNrHmvneyYrhuWTTcZr2sT81JGok8DFuTG9aujqmrtPZGAfY_pVv_ycBWPQVYqvU-8VeHI71U

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=O9XxdosRRoiQ9w1VhPG22g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIObgmEXzgokEQi37CA5EaNrHmvneyYrhuWTTcZr2sT81JGok8DFuTG9aujqmrtPZGAfY_pVv_ycBWPQVYqvU-8VeHI71U
date: Mon, 29 Nov 2021 11:26:18 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BB68
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAuoEYzEJk96WOqqVVYRzDc&google_cver=1&google_push=AYg5qPJqODVCHybTTKYiFaviW7qW5RqGCzhZQFGgHfA939-2YbqqsB0KX33RZt9Hh9t6IM1CXSu...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVRQlgtRS03NDE1&google_push=AYg5qPJqODVCHybTTKYiFaviW7qW5RqGCzhZQFGgHfA939-2YbqqsB0KX33RZt9Hh9t6IM1CXSulYBdL1RsAYembwCWrZPRJg0s

170 B
188 B

64ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVRQlgtRS03NDE1&google_push=AYg5qPJqODVCHybTTKYiFaviW7qW5RqGCzhZQFGgHfA939-2YbqqsB0KX33RZt9Hh9t6IM1CXSulYBdL1RsAYembwCWrZPRJg0s

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1dLTDVRQlgtRS03NDE1&google_push=AYg5qPJqODVCHybTTKYiFaviW7qW5RqGCzhZQFGgHfA939-2YbqqsB0KX33RZt9Hh9t6IM1CXSulYBdL1RsAYembwCWrZPRJg0s
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame BB68
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YaS42enVbr8Gi-MWeoCQnwAABFYAAAIB&google_gid=CAESEJWOQzzCnhLakl1x8a7Qd4I&google_push=AYg5qPL7fAKW-BnOwW8UghZQo6-AO4DTP99ZfdPBG17TeHUOx3b...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BB68
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEDY4g9Vtv9ZdCLrRWsPj4f8&google_cver=1&google_push=AYg5qPLal4nvg5KB0dyVoDMe...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLal4nvg5KB0dyVoDMeV0U7je4gBuGAmnIT-f1vi3VHJq9lXtY3sRNHPDsdwZK2XDHcay3zP-bE3BIvchSUcKFWDrPjrrZp&google_hm=

170 B
188 B

63ms
63ms

Image
image/png

142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLal4nvg5KB0dyVoDMeV0U7je4gBuGAmnIT-f1vi3VHJq9lXtY3sRNHPDsdwZK2XDHcay3zP-bE3BIvchSUcKFWDrPjrrZp&google_hm=

Requested by

Protocol

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 29 Nov 2021 11:26:19 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPLal4nvg5KB0dyVoDMeV0U7je4gBuGAmnIT-f1vi3VHJq9lXtY3sRNHPDsdwZK2XDHcay3zP-bE3BIvchSUcKFWDrPjrrZp&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Sun, 28 Nov 2021 11:26:19 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame BB68 0
12 B 62ms
61ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ki2gjUy2jeFk6NhzwHxaaIQ-DnqC6oK2z92-OkZE5jwHp-EKOthuDqEd_z8UTfxriaCcpDjw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS