steprimo.com Open in urlscan Pro
2606:4700:e2::ac40:851e  Public Scan

4 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 92

• https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B25303455.319684981;dc_trk_aid=512113641;dc_trk_cid=161273136;ord=3497425785;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= HTTP 302
• https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B25303455.319684981;dc_pre=CK2kmY-cm_UCFWbIuwgdFUwBww;dc_trk_aid=512113641;dc_trk_cid=161273136;ord=3497425785;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=

Request Chain 110

• https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPKMVo-6d6B3TR2xGaJuhdCtAflvnavqL-YIVSMTpbtviyz64wbKy3bZmCTfsCLts-F26KJgaNxVS_c1_SROzjN9oaxNMGM&google_gid=CAESEESDF4UhAr-3opAB34RqUpg&google_cver=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWRYZ2tRQUFBWEtyQGh5YQ&google_push=AYg5qPKMVo-6d6B3TR2xGaJuhdCtAflvnavqL-YIVSMTpbtviyz64wbKy3bZmCTfsCLts-F26KJgaNxVS_c1_SROzjN9oaxNMGM

Request Chain 111

• https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESENnqmYqEVQafuLPXtuDp7-Y&google_push=AYg5qPJm0nfMIXLzY-U1SA3ntgxQ3IvcGVQQVWZtUVhE7vIGmK8Y1LDUEnvasSaawWMfhCfA2MLXEdloCqwL4yCeoxJNr4lZ06E&google_cver=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPJm0nfMIXLzY-U1SA3ntgxQ3IvcGVQQVWZtUVhE7vIGmK8Y1LDUEnvasSaawWMfhCfA2MLXEdloCqwL4yCeoxJNr4lZ06E&google_hm=MTA4MTY4MDE4ODEyMDc1MTYxNzc

Request Chain 113

• https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESENz--ML_X460qfmOQHOmmv0&google_cver=1&google_push=AYg5qPKA4gqFTwWpXgsBbyydcJ70AFj6i0gsFeoVa2mzOlHEIGPr1R0lJYtbyHq1Hs5LunOrnOmBZ4wr08aLRl2jPmoBMb3z3U4 HTTP 302
• https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESENz--ML_X460qfmOQHOmmv0&google_cver=1&google_push=AYg5qPKA4gqFTwWpXgsBbyydcJ70AFj6i0gsFeoVa2mzOlHEIGPr1R0lJYtbyHq1Hs5LunOrnOmBZ4wr08aLRl2jPmoBMb3z3U4&rdf=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=3pJ686REStSqw_ySDZw4bg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKA4gqFTwWpXgsBbyydcJ70AFj6i0gsFeoVa2mzOlHEIGPr1R0lJYtbyHq1Hs5LunOrnOmBZ4wr08aLRl2jPmoBMb3z3U4

Request Chain 114

• https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPbBQeztdNBI49Brr5a3W1E&google_cver=1&google_push=AYg5qPLA-54JxpQdc6vbyvfNvx0_04SI3kY06h36__empa1xQVDRmB8jQzLKIy2tXG3yYSprkx-ugSEfsSnMaRc_SGlGKmQz7rs HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1kxVjQ1UjUtRy1INU0=&google_push=AYg5qPLA-54JxpQdc6vbyvfNvx0_04SI3kY06h36__empa1xQVDRmB8jQzLKIy2tXG3yYSprkx-ugSEfsSnMaRc_SGlGKmQz7rs

Request Chain 115

• https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU&s=184023&C=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU

Request Chain 117

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 124

• https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPI5wTzi72eM4tLpIHUYj0296cIjzMDStySoSidbQV6y8R_dAD4aW_uJ4m0K5b9E0tocTMZW1sEJiizS0CUVPTyyweO1MdCN&google_gid=CAESEIZgEEhC16yKF4wpl5U-lwQ&google_cver=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWRYZ2tRQUFCWlhNMkc2aA&google_push=AYg5qPI5wTzi72eM4tLpIHUYj0296cIjzMDStySoSidbQV6y8R_dAD4aW_uJ4m0K5b9E0tocTMZW1sEJiizS0CUVPTyyweO1MdCN

Request Chain 125

• https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLAZE2p5I4xqd9tj4rn4OoLtwg6M6yaqAchV65XDKEn9ge3AqZQTgQz-77LwdcQCdpUkiiuq8c8xhWRlGdRdTTfiHiAF_4v&google_gid=CAESEM2x2OSC_su2f8lBl-6jba0&google_cver=1 HTTP 302
• https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLAZE2p5I4xqd9tj4rn4OoLtwg6M6yaqAchV65XDKEn9ge3AqZQTgQz-77LwdcQCdpUkiiuq8c8xhWRlGdRdTTfiHiAF_4v&google_gid=CAESEM2x2OSC_su2f8lBl-6jba0&google_cver=1&rd=Y HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMDUxODE2NTAwMDAyMTMxNTQ4NjU4MQ%3D%3D&google_push=AYg5qPLAZE2p5I4xqd9tj4rn4OoLtwg6M6yaqAchV65XDKEn9ge3AqZQTgQz-77LwdcQCdpUkiiuq8c8xhWRlGdRdTTfiHiAF_4v

Request Chain 126

• https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEKv1enKGW1enfYqoXAlN4dI&google_push=AYg5qPLvNILmakpo39PNKlAMqNqNj0gACpds9gjBlH6WOnBYhKaZkpCXizsg0hmTI7kCc2ujX7dYptpZ9gI5JIFvQkXgDG7pkUog&google_cver=1 HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPLvNILmakpo39PNKlAMqNqNj0gACpds9gjBlH6WOnBYhKaZkpCXizsg0hmTI7kCc2ujX7dYptpZ9gI5JIFvQkXgDG7pkUog&google_hm=MTA4MTY4MDE4ODEyMDc1MTYxNzc

Request Chain 127

• https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEEWqekvMbb2KAmrNzxqmPAc&google_cver=1&google_push=AYg5qPIN0oGbaj6bul1IGdGcIwRp_w2a15aRQTHQAdfFLb6QwTfg13Nge3wtelbxEWEXvRZmHty43kVtocRxg9SZoMLIOVO6mrLb HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=GsrZ1fdtROSB_o50ZepW5w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIN0oGbaj6bul1IGdGcIwRp_w2a15aRQTHQAdfFLb6QwTfg13Nge3wtelbxEWEXvRZmHty43kVtocRxg9SZoMLIOVO6mrLb

Request Chain 128

• https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHdDd_JOSBGziI5tD9CnzCI&google_cver=1&google_push=AYg5qPLqTWtJoibUItfkqlQt1F1lSpF1V1D5EQJrTkg6vmIcC0qC80FXlQ6SgZM6WnVftBEhbSKOz05VIUfHBJD48F9TT0_ss9AH HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1kxVjQ1VDctVC1FS1BJ&google_push=AYg5qPLqTWtJoibUItfkqlQt1F1lSpF1V1D5EQJrTkg6vmIcC0qC80FXlQ6SgZM6WnVftBEhbSKOz05VIUfHBJD48F9TT0_ss9AH

Request Chain 129

• https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA

Request Chain 144

• https://www.google.com/pagead/drt/ui HTTP 302
• https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

156 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
9 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/	52 KB 13 KB	205ms 168ms	Document text/html	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash bccf8437331688f0d87e4d3ddda903b6a4dc71022c81fe793da4db71518c4298 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers date Wed, 05 Jan 2022 18:16:47 GMT content-type text/html; charset=UTF-8 cache-control private, max-age=0, must-revalidate, no-cache, no-store display orig_site_sol expires Tue, 04 Jan 2022 18:16:47 GMT pagespeed off pragma no-cache response 200 vary Accept-Encoding Accept-Encoding,User-Agent x-ezoic-cdn Miss x-middleton-display orig_site_sol x-middleton-response 200 x-origin-cache-control no-store, no-cache, must-revalidate x-sol orig cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CKomuuHiRaxUGExei253EV0zlEzeIfijIzeLX5jOIhUcXHTHbqa4BPLBOjfz%2FNdfKeQSZ5voY3kTyf70s9fHDV0Kraqeuuhf0%2FSA7qwoQYm39X13wlN4OGOyMSDZINimqwMgx3YvDnP%2F34M%3D"}],"group":"cf-nel","max_age":604800} nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare cf-ray 6c8eb322aba24a79-FRA content-encoding br alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	css.css steprimo.com/css/	24 KB 5 KB	24ms 23ms	Stylesheet text/css	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/css/css.css Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 13ae4ff9b0fde331ad76c96896429b082ab5aa116f0416c91dde7301591090c8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:47 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 9906023 cf-polished origSize=31890 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Tue, 18 May 2021 23:41:50 GMT server cloudflare etag W/"7c92-5c2a3410d5e57-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yzRwo0v2Kt1j5Pje4zxolyOIYLUYWBufV21jV4ZHyIq%2B0W3ODd4Sk9FzoJwtZnxJfHvLFJT3Qsc8qJoEgXprJuO5uzOOUioCV9DL2pJ9NCiGOR5Hh1OZ5zdlGRb3zwUnx3fmF2RbU1yvX2c%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=31536000 cf-ray 6c8eb323ee804a79-FRA cf-bgj minify
GET H2	200	adsbygoogle.js Show response pagead2.googlesyndication.com/pagead/js/	145 KB 51 KB	89ms 67ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 110fa1a018bf08df8f37801965c2592b65a4eccd16e4c5d7821c6d259a06398b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51855 x-xss-protection 0 server cafe etag 13259471919307325271 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Wed, 05 Jan 2022 18:16:48 GMT
GET H2	200	invisible.js Show response steprimo.com/cdn-cgi/challenge-platform/h/g/scripts/	41 KB 15 KB	75ms 73ms	Script text/javascript	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash a0217b6ae2f7af4acebfe9f2781193d28e171523e7126e1e35758258032a6fd4 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HD2yDs%2BmvEBES4a1tIbBQ8pE9aV6V8ABpFDR4mmNwjfMYcAwt6iTBtxOpljTZE6ruzdk2kuMeICSYqim2EQLor4peQolqeDd9Qd5HHawDMNEz8sOhLPhNIjd0p5M7%2FLQj%2FG5%2BjwJhsYnpTc%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript cache-control max-age=604800, public x-control-type-options nosniff cf-ray 6c8eb3241efe4a79-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	Uo5ruDkX40y5i5nZ6Y0IW1nAic4HLgrzjYPf1Cd9MBcAfroOto32yPOHgIxflxlf7Es=s200 lh3.googleusercontent.com/	16 KB 16 KB	182ms 146ms	Image image/png	2a00:1450:4001:831::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://lh3.googleusercontent.com/Uo5ruDkX40y5i5nZ6Y0IW1nAic4HLgrzjYPf1Cd9MBcAfroOto32yPOHgIxflxlf7Es=s200 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 720720ffd871b3a30dfd96e1a5b13e1feea9d65ec838c93cc7498c020e4b37d9 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT x-content-type-options nosniff age 0 content-disposition inline;filename="unnamed.png" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16100 x-xss-protection 0 server fife etag "v1" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Tue, 04 Jan 2022 13:40:14 GMT
GET H2	200	placeholder-img.png steprimo.com/images/	8 KB 8 KB	34ms 32ms	Image image/png	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://steprimo.com/images/placeholder-img.png Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 62872c10fa87bf037b9ca89af7cd6a0684126fd8222cdee497b61d25577a1036 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 6096426 x-ezoic-cdn Hit ds;mm;1341c30fb407078355ea30b071c20ea6;2-293506-0;dbecb543-c672-40e9-7275-d4fea76e4ffc x-middleton-display staticcontent_sol, staticcontent_sol x-middleton-response 200 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-origin-cache-control max-age=31536000 response 200 last-modified Tue, 13 Jul 2021 14:05:09 GMT server cloudflare etag W/"1e19-5c06e5239ab80-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, User-Agent,Origin,Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aS359qbC4RpMyhvFP9DqX9CdPmYGo2aEjZMlXUFsUjEYODNENXIIei%2B4FrPE4GNO11T%2Fha5ZXlDh6DJ%2FG2wS6mSv%2FMhUMt8spNkz5U1idd7F39XsMYgkyi8eHbdLwNzDEzGxWuY6UYaejiA%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=31536000 cf-ray 6c8eb3241f004a79-FRA display staticcontent_sol, staticcontent_sol
GET H2	200	placeholder-img1.png steprimo.com/images/	4 KB 4 KB	23ms 22ms	Image image/png	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://steprimo.com/images/placeholder-img1.png Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 19bf3c6c8309e4b98f026648daf535bbf354871e0f9fbfb4da0e23f2f66a2248 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 41620 x-ezoic-cdn Hit ds;mm;086a4e0147cee70ed256dd8fec5cefd5;2-293506-0;ffc72566-423a-4878-52e4-1e64e2ab7caa x-middleton-display staticcontent_sol x-middleton-response 200 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-origin-cache-control max-age=31536000 response 200 last-modified Tue, 13 Jul 2021 14:05:09 GMT server cloudflare etag W/"efc-5c06e5412b140-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, User-Agent,Origin,Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kSAX4nEzdO4zUvkc4ya0C99EbMSXWvM0kSiQanSyBR3x4W9v1HYw7zdw36LW6zrIDaaXRrijfIjDG0jTwrI9%2Fb0dM81VhGDiYQTb2p9WNjv9KFxy0woEfEAVsIPC1ZCOPbFvo9vq2hnc7NI%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=31536000 cf-ray 6c8eb3241f024a79-FRA display staticcontent_sol
GET H2	200	jquery.min.js Show response steprimo.com/js/	84 KB 31 KB	32ms 31ms	Script application/javascript	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/js/jquery.min.js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 41620 x-ezoic-cdn Hit ds;mm;4fd6fe664c13f8ac0f39580d66e6fcaf;2-293506-0;f92fba2f-1b50-44b2-5f1d-d3595d24d37b x-middleton-display staticcontent_sol x-middleton-response 200 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-origin-cache-control max-age=31536000 response 200 last-modified Tue, 13 Jul 2021 14:05:09 GMT server cloudflare etag W/"14e4a-5b7a33daf3c80-gzip-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding,User-Agent,Origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8G6kqURYym3JKzt7mUTlJGOWoUUFhGjvYT6RE0Apnmtrtt3E3Jj97BSNhl5LPpcvDMx4LjV2QSIzo%2BJT9RI51cpm48DnDVFSgshXW7iFeErU1k41nIjyXuy%2BkQo%2Bf4GsTpEh3CCzkcXAXko%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=31536000 cf-ray 6c8eb3240ee54a79-FRA display staticcontent_sol
GET H2	200	js.js Show response steprimo.com/js/	5 KB 2 KB	34ms 32ms	Script application/javascript	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/js/js.js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3241cdf2c501f687589772a2265da0e0900040ce36642908430c665169042bc3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 11637538 cf-polished origSize=6415 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Tue, 18 May 2021 21:38:55 GMT server cloudflare etag W/"190f-5c2a1897199c0-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S7MTP1Q3sRymdxJKGied1ARTKpBC8ieWWC7RSlcGUKilc7rPG0J9tbvT7UAH64PLyVL95AGMkjA6kMEk1aY%2BSXrP7pbk1gpGKODZKOjGKgFe63iXJyEiMZaY1Kg%2FpktRubqN7hhhgnK9SQ8%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=31536000 cf-ray 6c8eb3241ef54a79-FRA cf-bgj minify
GET H2	200	jquery.fancybox.min.js Show response steprimo.com/js/	67 KB 22 KB	25ms 23ms	Script application/javascript	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/js/jquery.fancybox.min.js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cadda460ccb4c3c01bb45f3d5976f63f5adf8dc3ff1d31cb4fbd3ded4f18e5bf Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 22089000 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Wed, 30 Dec 2020 00:03:46 GMT server cloudflare etag W/"10a9d-5b7a33daf3c80-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BuMFdERZEik7vWxN1BZWDWYecBAWDTH8R2xv7yNpJdcapV%2BbQaKPokqQpgCaDeJWgumUZ8WzN1fC49FQNQjKnfG3AD7y0GYxRjfh%2Fr63cgVvHlY9tnLUMiQB%2FTb90ew3wWWC50O%2FLtxD9z4%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=31536000 cf-ray 6c8eb3241ef64a79-FRA expires Mon, 25 Apr 2022 02:26:48 GMT
GET H2	200	font-awesome.min.css steprimo.com/css/	30 KB 7 KB	23ms 21ms	Stylesheet text/css	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/css/font-awesome.min.css Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br vary Accept-Encoding, Accept-Encoding,User-Agent,Origin cf-cache-status HIT x-sol orig age 7486622 x-ezoic-cdn Hit ds;ms;e1c983b4ffa8eb5c603d852077e20288;2-293506-0;6fd42657-7659-4a8e-72b7-96a57b99d141 x-middleton-display staticcontent_sol, orig_site_sol x-middleton-response 200 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-origin-cache-control max-age=31536000 response 200 last-modified Tue, 13 Jul 2021 14:05:09 GMT server cloudflare etag W/"7918-5b7a33c228200-gzip-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BuedDN0gG6LQNUwCnl%2FzbfNIx%2BkmGyOHr6Ablu%2FgrKSSVxdhk7xMDcPj%2FS7XYsWZMrdMximmI9jkHZYoMPnKQMjI18jW9udA4IArW0T%2BLnk%2Fz9866PzSuL41hyJX0vXkG3Vyt8VLxYdkU9I%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=31536000 cf-ray 6c8eb3241ef94a79-FRA display staticcontent_sol, orig_site_sol
GET H2	200	jquery.fancybox.min.css steprimo.com/css/	12 KB 4 KB	32ms 30ms	Stylesheet text/css	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/css/jquery.fancybox.min.css?version=1 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br vary Accept-Encoding, Accept-Encoding,User-Agent,Origin cf-cache-status HIT x-sol orig age 6147753 x-ezoic-cdn Hit ds;mm;24e8404b8280a599389617a29cb783b7;2-293506-0;edc1faa4-ac92-4f4b-54e3-da623798601c x-middleton-display staticcontent_sol, orig_site_sol x-middleton-response 200 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-origin-cache-control max-age=31536000 response 200 last-modified Tue, 13 Jul 2021 14:05:09 GMT server cloudflare etag W/"31fb-5b7a33c03fd80-gzip-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DvnmZ3ZIRP588o52DCvexvhYgVFCRtgLg03Z64X2eO3lQX96yTMg%2FaCYwbY4ie5FmbTnXm0XiBXdDEZ6OquoAhDciLDd%2FQKxfnKNlZWzOeR0IfCt9VgAws648civ3ICJdY1BPtVZyrpZVKw%3D"}],"group":"cf-nel","max_age":604800} content-type text/css cache-control max-age=31536000 cf-ray 6c8eb3241efb4a79-FRA display staticcontent_sol, orig_site_sol
GET H2	200	js Show response www.googletagmanager.com/gtag/	90 KB 36 KB	41ms 19ms	Script application/javascript	2a00:1450:4001:80f::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=UA-133234767-7 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 98dcf6b07a95c526d0c7564a88ae37a93235969babe9e03cb8d9e786a4ed28dd Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36180 x-xss-protection 0 last-modified Wed, 05 Jan 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Wed, 05 Jan 2022 18:16:48 GMT
GET H2	200	imglazyload.js Show response steprimo.com/js/	1 KB 1 KB	33ms 32ms	Script application/javascript	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/js/imglazyload.js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 5b1e5c174ab8e9241923ade19fae123102be409bd8856be00e82f8adf5682174 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 5936214 cf-polished origSize=2133 x-ezoic-cdn Hit ds;mm;77ba2d46b4fcc6c2fbf5da3d4fb9b808;2-293506-0;d39f6569-8ef1-449e-5724-67c9e9011744 x-middleton-display staticcontent_sol, staticcontent_sol x-middleton-response 200 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 x-origin-cache-control max-age=31536000 response 200 last-modified Tue, 13 Jul 2021 14:05:09 GMT server cloudflare etag W/"855-5b7a33dbe7ec0-gzip-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding,User-Agent,Origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WVvadd5qyYzf4tB1o%2Fu97BeDgYH5Y4wcPoEY9kekMxhhdNOjwWKp%2BMr9qoYGxmxR2HD8HQY28PqlvEY1OpvgP6TEglFOwVKmJQe5hZP4RAcyEmpttUaT%2FdvnKahLQC6aB8bMFIUBmvY035U%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control max-age=31536000 cf-ray 6c8eb3241efc4a79-FRA display staticcontent_sol, staticcontent_sol cf-bgj minify
GET H2	200	cmbv2.js Show response steprimo.com/detroitchicago/	657 KB 178 KB	36ms 35ms	Script application/javascript	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-5y06-12y07-1y19-5y0b-5y0d-14y13-3y17-4y1c-2y21-3y53-1&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1cx21x53 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash b349ea92b8120b1a3e36bd784ad6850a40102c19c2e801b117c8d7115d4c7695 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 1892011 cf-polished origSize=673918 cf-ray 6c8eb3241f054a79-FRA x-middleton-display sol-js alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Tue, 14 Dec 2021 20:43:17 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JjbcApkMHsg2JUbFgKkXit0eZQlIGzCrIl55SbFNzH7SSzB0iHOaw2kk7uydTkEcHsnsUe0n9NkOdovSG4uqzGinoCem1EM49Bzw%2BC9PwIHj0uKDJ1YNcK7tG510VjDJEgrGax4awUUXdfo%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=31536000 x-robots-tag noindex cf-bgj minify
GET H2	200	logo.png steprimo.com/images/	14 KB 14 KB	31ms 30ms	Image image/png	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://steprimo.com/images/logo.png Requested by Host: steprimo.com URL: https://steprimo.com/css/css.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3e49777ac2f5c3e1770351d447c31b47ae8cb65c1f825d09a33d6373aee34ba Request headers Referer https://steprimo.com/css/css.css Origin https://steprimo.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 17067712 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 13970 last-modified Tue, 20 Apr 2021 21:11:22 GMT server cloudflare etag "3692-5c06de35c5280" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary User-Agent, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gaGFond4jYhWjaiNc5gS32oTPLCYsexUiPlKYhU%2FgqtWzZVMB3uWRTjnDweyhFnSscZqDx1cXvOKGUT86R%2FN%2Fa4BFAO%2FnonbbGsVUED%2FsJQ2CN7%2FIGBVZalHswx%2B5cvDcTZtEHl8PIN05ys%3D"}],"group":"cf-nel","max_age":604800} content-type image/png cache-control max-age=2592000 accept-ranges bytes cf-ray 6c8eb3241f174a79-FRA expires Sun, 23 May 2021 05:13:56 GMT
GET H2	200	fontawesome-webfont.woff2 steprimo.com/fonts/	75 KB 76 KB	21ms 20ms	Font font/woff2	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/fonts/fontawesome-webfont.woff2?v=4.7.0 Requested by Host: steprimo.com URL: https://steprimo.com/css/font-awesome.min.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe Request headers Referer https://steprimo.com/css/font-awesome.min.css Origin https://steprimo.com Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT cf-cache-status HIT last-modified Thu, 22 Dec 2016 13:50:34 GMT server cloudflare age 9906024 etag W/"12d68-5443f8dab5e80-gzip" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9t2s9mp2AO19Di6EemUVhk8pj%2F9pmOKS3stS%2FCLv8uuKka3YbnGR7zF8Eq0ohXZFAROat%2FQYPUPhz6S2Y%2BGFOjjvfL6SYNy5UJRXeqGW40qXsnMjB45XPc7zcnpy699y24svS9iK%2B%2FQPMHQ%3D"}],"group":"cf-nel","max_age":604800} content-type font/woff2 cache-control max-age=31536000 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 6c8eb324b8864a79-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	ept1kKoG2tB3oQ5z9w1eAuCiqobGNxQoEBAiLHHFvbP0pu1WWy4UYoRkPdAO8JZkLNg lh3.googleusercontent.com/	99 KB 99 KB	502ms 502ms	Image image/png	2a00:1450:4001:831::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://lh3.googleusercontent.com/ept1kKoG2tB3oQ5z9w1eAuCiqobGNxQoEBAiLHHFvbP0pu1WWy4UYoRkPdAO8JZkLNg Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 47186b4ae479d1938d0e4346ed268ce48bd7c0387d4ea11411b6f269796e7b7e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT x-content-type-options nosniff age 0 content-disposition inline;filename="unnamed.png" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 101232 x-xss-protection 0 server fife etag "v1" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Tue, 04 Jan 2022 13:40:14 GMT
GET H2	200	egFcqYYUaHJhE5AUGYOn1qjEAaj7RZlvif6n8v48iIeGAAlpbpjgMfNJhv0Xu-uF_w4 lh3.googleusercontent.com/	71 KB 71 KB	419ms 418ms	Image image/png	2a00:1450:4001:831::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://lh3.googleusercontent.com/egFcqYYUaHJhE5AUGYOn1qjEAaj7RZlvif6n8v48iIeGAAlpbpjgMfNJhv0Xu-uF_w4 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 42b3f32f58e961e6a9c24b59cead699cab7934e24d2c474b9d9da5e942c94de3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT x-content-type-options nosniff server fife etag "v1" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform content-disposition inline;filename="unnamed.png" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 72605 x-xss-protection 0 expires Thu, 06 Jan 2022 18:16:48 GMT
GET H2	200	H-wgyyeWCPBxdloCmDAVqEBOlX2R2U4rajDcLYLTtZYjiQPy66up24ge-o-8vzZYZw lh3.googleusercontent.com/	59 KB 59 KB	449ms 448ms	Image image/png	2a00:1450:4001:831::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://lh3.googleusercontent.com/H-wgyyeWCPBxdloCmDAVqEBOlX2R2U4rajDcLYLTtZYjiQPy66up24ge-o-8vzZYZw Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash befce9bb78bdcb92beca9ad7276111da342c0e4ea5f9721384968138fc5d55cf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT x-content-type-options nosniff age 0 content-disposition inline;filename="unnamed.png" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 60122 x-xss-protection 0 server fife etag "v1" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Tue, 04 Jan 2022 13:40:14 GMT
GET H2	200	7LfL6phhfvTT9RNUjssOsAVudftf6b-QkMJ0WtzgsI2xtqaD2RxlLD10EICsZqH0U8js lh3.googleusercontent.com/	71 KB 71 KB	329ms 329ms	Image image/png	2a00:1450:4001:831::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://lh3.googleusercontent.com/7LfL6phhfvTT9RNUjssOsAVudftf6b-QkMJ0WtzgsI2xtqaD2RxlLD10EICsZqH0U8js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software fife / Resource Hash 8ca67bdcbcdb09aa21562d0c6e50166f9b64686712031aef2f4069d2e0ab42a6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT x-content-type-options nosniff age 0 content-disposition inline;filename="unnamed.png" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 72962 x-xss-protection 0 server fife etag "v1" vary Origin content-type image/png access-control-allow-origin * access-control-expose-headers Content-Length cache-control public, max-age=86400, no-transform timing-allow-origin * expires Tue, 04 Jan 2022 13:40:14 GMT
GET H2	200	show_ads_impl_with_ama_fy2019.js Show response pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/	276 KB 100 KB	35ms 35ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 00db1163ca6054f2a8496a8613addd64991e27eedc8a136ca3e1f9dc04e894f8 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 101734 x-xss-protection 0 server cafe etag 4507154694380913909 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600, stale-while-revalidate=3600 timing-allow-origin * expires Wed, 05 Jan 2022 18:16:48 GMT
GET H2	200	zrt_lookup.html Show response googleads.g.doubleclick.net/pagead/html/r20211207/r20190131/ Frame 82F8	11 KB 5 KB	29ms 7ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20211207/r20190131/zrt_lookup.html Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin vary Accept-Encoding date Tue, 04 Jan 2022 18:37:20 GMT expires Tue, 18 Jan 2022 18:37:20 GMT content-type text/html; charset=UTF-8 etag 17731914101004188133 x-content-type-options nosniff content-encoding gzip server cafe content-length 4884 x-xss-protection 0 age 85168 cache-control public, max-age=1209600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	imp.gif Show response steprimo.com/detroitchicago/	43 B 635 B	388ms 88ms	XHR image/gif	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_lazyload_version%22%3A0%2C%22ad_load_version%22%3A0%2C%22city%22%3A%22%22%2C%22country%22%3A%22GB%22%2C%22days_since_last_visit%22%3A-1%2C%22domain_id%22%3A293506%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A1%2C%22ezcache_skip_code%22%3A11%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22metro_code%22%3A0%2C%22page_ad_positions%22%3A%22%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%22199988ee-1104-4867-7594-ca7afe703d47%22%2C%22position_selection_id%22%3A0%2C%22postal_code%22%3A%22%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A45396%2C%22response_time_orig%22%3A45%2C%22serverid%22%3A%2235.158.111.255%3A26152%22%2C%22state%22%3A%22%22%2C%22t_epoch%22%3A1641406607%2C%22template_id%22%3A120%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F%22%2C%22user_id%22%3A0%2C%22weather_precipitation%22%3A0%2C%22weather_summary%22%3A%22%22%2C%22weather_temperature%22%3A0%2C%22word_count%22%3A676%2C%22worst_bad_word_level%22%3A0%7D&ez_orig=1 Requested by Host: steprimo.com URL: https://steprimo.com/detroitchicago/cmbv2.js?gcb=195-0&cb=04-1y02-5y06-12y07-1y19-5y0b-5y0d-14y13-3y17-4y1c-2y21-3y53-1&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1cx21x53 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT cf-cache-status BYPASS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7b2LC4kcp0MT2XojGLcDrfrXMtcB4weLVgco9oBlA%2FTFU652gOQ04IOJHDiJMh1xrar2CQuq4o%2Bk4lTHb6q5vB4mrT%2F8b43j6JtyO8XQWqwAKjIkQcj%2BPWHPSBpG0aS7J3wHIQuHvZmEiLA%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif x-middleton-display imp_sol cache-control private, max-age=0, must-revalidate, no-cache, no-store accept-ranges bytes cf-ray 6c8eb3270e1f4a79-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 43 expires Tue, 04 Jan 2022 18:16:48 GMT
GET H2	200	cmbdv2.js Show response steprimo.com/detroitchicago/	44 KB 11 KB	363ms 62ms	Script application/javascript	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/detroitchicago/cmbdv2.js?gcb=195-0&cb=03-5y0c-5y18-4&cmbcb=20&sj=x03x0cx18 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 22b3b39cbdbf2e1410fcaa21b8ca17d1020a13a90e1b79fb828219520ae7423d Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 7926561 cf-polished origSize=44604 cf-ray 6c8eb3272e6f4a79-FRA x-middleton-display sol-js alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Wed, 06 Oct 2021 00:27:27 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding, Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vwFYwHJ8S3FEJVkHPvG4CdeZEi%2FKEQ%2BAI1y5%2BA9b8txr0i3LGhVSOJoDCwZrd9AY2xIzEkj0ma2sk6lZqM5mLkTFuHZgCjh23feygbXIK3T9lhM6XniAXL4%2FdjuJEZUEUs4ankXPufit%2FD4%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript cache-control public, max-age=31536000 x-robots-tag noindex cf-bgj minify
GET H2	200	pica.js steprimo.com/cdn-cgi/challenge-platform/h/g/scripts/	20 KB 7 KB	368ms 68ms	Other text/javascript	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/cdn-cgi/challenge-platform/h/g/scripts/pica.js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e630e2c7d7150da46767c8b0498d75d8662e8aec2ca9e744e42ae58efd112d59 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding br nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jmWDh69WQxo4hVvLCB8ZbaVxRKu%2FyzUp%2BDfsgzjWPjnmnB0ptu7eyft%2BulADmke%2FU66S%2Bi0cL%2FmvI%2BrvNta9DAP82FkKHbjZatNDSa%2Fbfuft3uR31FgwS38j1rWcBxv5icleJJmXzQFT94U%3D"}],"group":"cf-nel","max_age":604800} content-type text/javascript cache-control max-age=604800, public x-control-type-options nosniff cf-ray 6c8eb3272e6b4a79-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	32ms 6ms	Script text/javascript	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=UA-133234767-7 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Tue, 02 Nov 2021 17:39:06 GMT server Golfe2 age 4542 date Wed, 05 Jan 2022 17:01:06 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Wed, 05 Jan 2022 19:01:06 GMT
GET BLOB	200 OK	b266aa71-d3e4-4f2c-ba95-e43061d6c171 https://steprimo.com/	31 B 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://steprimo.com/b266aa71-d3e4-4f2c-ba95-e43061d6c171 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Length 31 Content-Type application/javascript
GET H2	200	cookie.js Show response partner.googleadservices.com/gampad/	216 B 648 B	39ms 16ms	Script text/javascript	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://partner.googleadservices.com/gampad/cookie.js?domain=steprimo.com&callback=_gfp_s_&client=ca-pub-4851232067898831 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software cafe / Resource Hash e2340be43c91e78a474404fe53a3585a71c3ffd856cb2ca020d6b741479ed9ae Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type text/javascript; charset=UTF-8 cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 204 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.de/adsid/	107 B 792 B	52ms 16ms	Script application/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=steprimo.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 549 B	38ms 15ms	Script application/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=steprimo.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	39ms 39ms	Image image/gif	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&tn=DIV&cls=Share_Btn&ign=false&pw=1600&ph=1200&x=1575&y=1175 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:48 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	39ms 39ms	Image image/gif	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&tn=HEADER&id=header&ign=false&pw=1600&ph=1200&x=0&y=0 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:48 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ads Show response googleads.g.doubleclick.net/pagead/ Frame 4788	160 KB 43 KB	604ms 589ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&adk=1812271804&adf=3025194257&lmt=1641406608&plat=1%3A16777216%2C2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608143&bpp=3&bdt=184&idt=100&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6820309366325&frm=20&pv=2&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=113 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 0847ce74aea89bd254885078661992912b00ef88e90b0d17ba16e86692e5e0f5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 05 Jan 2022 18:16:48 GMT server cafe content-length 43524 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 05 Jan 2022 18:16:48 GMT cache-control private
GET H3	200	ads Show response googleads.g.doubleclick.net/pagead/ Frame 9451	87 KB 29 KB	612ms 604ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 1df2abc2cd92c917248cb09ff90113c993871f00ca71e09ec0b0ca1f231a2ba6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 05 Jan 2022 18:16:48 GMT server cafe content-length 29744 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 05 Jan 2022 18:16:48 GMT cache-control private
POST H3	200	collect Show response www.google-analytics.com/j/	1 B 21 B	27ms 13ms	XHR text/plain	2a00:1450:4001:82b::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1470911136&t=pageview&_s=1&dl=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&ul=en-us&de=UTF-8&dt=Download%20Amex%20Business%20Free%20for%20Android%20-%20Amex%20Business%20APK%20Download%20-%20STEPrimo.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=666670&gjid=31407134&cid=1753832092.1641406608&tid=UA-133234767-7&_gid=1687090694.1641406608&_r=1&gtm=2ouc10&z=1541062141 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://steprimo.com/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:48 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://steprimo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ads Show response googleads.g.doubleclick.net/pagead/ Frame FE21	88 KB 29 KB	699ms 699ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 6b108d13200a1abb7964f182eeba1cf83f73fc228f1d19ebcee95783011ae0a6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 05 Jan 2022 18:16:48 GMT server cafe content-length 29764 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 05 Jan 2022 18:16:48 GMT cache-control private
GET H3	200	reactive_library_fy2019.js Show response pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/	149 KB 53 KB	39ms 39ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/reactive_library_fy2019.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash dbea79f2df0b90afb4a54efb447d86eeb387be30ca8387fb69b069a46ae4896a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 54388 x-xss-protection 0 server cafe etag 7489837695308457557 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=1209600 timing-allow-origin * expires Wed, 05 Jan 2022 18:16:48 GMT
GET H3	200	integrator.js Show response adservice.google.de/adsid/	107 B 122 B	31ms 16ms	Script application/javascript	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=steprimo.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	integrator.js Show response adservice.google.com/adsid/	107 B 122 B	32ms 16ms	Script application/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=steprimo.com Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response googleads.g.doubleclick.net/pagead/ Frame FCC5	89 KB 31 KB	699ms 699ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash c05f573b4fd11b024d857742bc4c6e38b2270c0805acb9d2bfaa3c4816a74e73 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 05 Jan 2022 18:16:49 GMT server cafe content-length 31929 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 05 Jan 2022 18:16:49 GMT cache-control private
GET H3	200	ads Show response googleads.g.doubleclick.net/pagead/ Frame 7AF4	78 KB 26 KB	976ms 975ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 4b7ae0006fd8d031f2e72a79491d66b1457a6809e08c3f8d4c822d29dfa82375 Security Headers Name Value Content-Security-Policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMvW9o6cm_UCFfI8YAod_IcKRg&gqi=kODVYaSROfWBwuIPhoKymAk&layout=/sadbundle/%24csp%253Der3%24/215047436056395776/index.html X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-security-policy child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMvW9o6cm_UCFfI8YAod_IcKRg&gqi=kODVYaSROfWBwuIPhoKymAk&layout=/sadbundle/%24csp%253Der3%24/215047436056395776/index.html content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 05 Jan 2022 18:16:49 GMT server cafe content-length 27035 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 05 Jan 2022 18:16:49 GMT cache-control private
GET H3	200	ads Show response googleads.g.doubleclick.net/pagead/ Frame CEB6	95 KB 34 KB	635ms 634ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f0f20ae131c1a40705644efda032e8ff993a8a9ccfa88b3a410ae23195edfafd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding br date Wed, 05 Jan 2022 18:16:49 GMT server cafe content-length 34383 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 05 Jan 2022 18:16:49 GMT cache-control private
GET H2	200	css fonts.googleapis.com/ Frame 9451	3 KB 1 KB	42ms 15ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 05 Jan 2022 18:15:13 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 05 Jan 2022 18:16:48 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 05 Jan 2022 18:16:48 GMT
GET H2	200	load_preloaded_resource_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 9451	1 KB 960 B	36ms 11ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/load_preloaded_resource_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:12:14 GMT content-encoding gzip x-content-type-options nosniff age 274 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 853 x-xss-protection 0 server cafe etag 7170004918125193417 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:12:14 GMT
GET H2	200	abg_lite_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame 9451	19 KB 8 KB	31ms 8ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:05:54 GMT content-encoding gzip x-content-type-options nosniff age 654 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7876 x-xss-protection 0 server cafe etag 5333878705136318229 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:05:54 GMT
GET H2	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 9451	2 KB 1 KB	34ms 11ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:15:42 GMT content-encoding gzip x-content-type-options nosniff age 66 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:15:42 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 9451	119 KB 37 KB	50ms 28ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:48 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 05 Jan 2022 18:16:48 GMT
GET H2	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 9451	15 KB 6 KB	31ms 9ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:10:55 GMT content-encoding gzip x-content-type-options nosniff age 353 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6464 x-xss-protection 0 server cafe etag 15715955993838318253 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:10:55 GMT
GET H2	200	6d065ef8aad4e53a06604e1059b7b7b3.js Show response www.gstatic.com/mysidia/ Frame 9451	27 KB 12 KB	30ms 8ms	Script text/javascript	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/mysidia/6d065ef8aad4e53a06604e1059b7b7b3.js?tag=mysidia_one_click_handler_one_afma_2019 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b138f0b28fe44581bebb03d0ff7046e4f8416deeb5d152ede640eaa3dc1c7872 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 22:16:39 GMT content-encoding gzip x-content-type-options nosniff age 158409 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11408 x-xss-protection 0 last-modified Mon, 06 Dec 2021 07:52:38 GMT server sffe cross-origin-opener-policy same-origin; report-to="mysidia" vary Accept-Encoding report-to {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]} content-type text/javascript cache-control public, max-age=7776000 accept-ranges bytes expires Sun, 03 Apr 2022 22:16:39 GMT
GET H3	200	adview googleads.g.doubleclick.net/pagead/ Frame 9451	0 0	51ms 50ms	Fetch text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/adview?ai=CqXX4kODVYYvMEoLHb9T5h8gCkLeAwGf285PAnA6P9JDj1wIQASDzkfEiYLsGoAGwysfpA8gBCagDAcgDywSqBIwCT9B6b58cyhEIS08yZqUmTBEHenBUjGysAC6qEuIEtjRxWsKESnF12Da1zYziGjK0bD0kM-aJaT5CuugYj-M653M73mRmnNXbHiZHF9y4yacXZb-whf8R73d8hfSlgXqFHwyDiKEpF5F7YH2n82ASqSU0AUFE_xVxH4kVsqFH2I91DSGiypqmig7alW6JCKXRFppli8vCi0jP7Gc6ZhGnZTkE2bIl-ZFcKvhEyR7fceZI20BPOOKjz1KMYBIqdKLTLSL3AEub3G51G10VZaXkRLqTPq2_yVbmBmiDHYkL1P8dy_QUAJSQVDB4QTu3dOHQT191k6RWLBGvznOGwd1PljSSBDZHisi9mQdhSsAEgITd89kDkgUECAQYAZIFBAgFGASgBi6AB7i1uBaoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBDR_k7SCAkIgOGAEBABGB-ACgHICwG4E4gn2BMM0BUBgBcBshccChoIABIUcHViLTQ4NTEyMzIwNjc4OTg4MzEYAA&sigh=vqHBBE01ekY&uach_m=[UACH]&template_id=5000 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe date Wed, 05 Jan 2022 18:16:48 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control private cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Wed, 05 Jan 2022 18:16:48 GMT
GET H2	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/6164345155216221391/ Frame 9451	30 KB 30 KB	30ms 12ms	Image image/jpeg	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/6164345155216221391/downsize_200k_v1?w=600&h=314 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 151afd575f4b00b568d248da576ede22127486f08849ca217f8e9c9b6021de86 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 22:29:07 GMT x-content-type-options nosniff age 71261 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 30494 x-xss-protection 0 last-modified Wed, 01 Sep 2021 17:57:00 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Wed, 04 Jan 2023 22:29:07 GMT
GET DATA	200 OK	truncated / Frame 9451	209 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f1177a5296ab0224e573cef3622310413a5efcc608aa2933a2e0a046d5b45233 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET H3	200	zrt_lookup.html Show response googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/ Frame 38AB	11 KB 5 KB	9ms 7ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d853164105815c3ea423a95f095ee531f547ff1e12fba56a80be0f712c62929e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" timing-allow-origin * cross-origin-resource-policy cross-origin vary Accept-Encoding date Tue, 04 Jan 2022 19:07:16 GMT expires Tue, 18 Jan 2022 19:07:16 GMT content-type text/html; charset=UTF-8 etag 17731914101004188133 x-content-type-options nosniff content-encoding gzip server cafe content-length 4884 x-xss-protection 0 age 83372 cache-control public, max-age=1209600 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	css2 fonts.googleapis.com/ Frame 38AB	4 KB 634 B	36ms 20ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 05 Jan 2022 18:15:16 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 05 Jan 2022 18:16:49 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	feedback_grey600_24dp.png www.gstatic.com/images/icons/material/system/2x/ Frame 38AB	205 B 229 B	22ms 7ms	Image image/png	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 17:24:00 GMT x-content-type-options nosniff age 3169 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 205 x-xss-protection 0 last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe vary Origin report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type image/png cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Thu, 05 Jan 2023 17:24:00 GMT
GET H3	200	settings_grey600_24dp.png www.gstatic.com/images/icons/material/system/2x/ Frame 38AB	604 B 628 B	22ms 8ms	Image image/png	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 20:32:52 GMT x-content-type-options nosniff age 164637 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 604 x-xss-protection 0 last-modified Tue, 22 Oct 2019 18:15:00 GMT server sffe vary Origin report-to {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} content-type image/png cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="static-on-bigtable" expires Tue, 03 Jan 2023 20:32:52 GMT
GET H3	200	interstitial_ad_frame_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/elements/html/ Frame 38AB	19 KB 8 KB	29ms 12ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/elements/html/interstitial_ad_frame_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 3d8693cddca8ef95b6b06ab98ad4ae68d7c7a30aa8d781e418c28b84bfcca7cd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:40:56 GMT content-encoding gzip x-content-type-options nosniff age 9353 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8415 x-xss-protection 0 server cafe etag 17051659159829090632 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:40:56 GMT
GET H3	200	css fonts.googleapis.com/ Frame FE21	3 KB 579 B	20ms 17ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 05 Jan 2022 18:16:41 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 05 Jan 2022 18:16:49 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	load_preloaded_resource_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame FE21	1 KB 880 B	9ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/load_preloaded_resource_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:40:07 GMT content-encoding gzip x-content-type-options nosniff age 9402 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 853 x-xss-protection 0 server cafe etag 7170004918125193417 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:40:07 GMT
GET H3	200	abg_lite_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/ Frame FE21	19 KB 8 KB	12ms 10ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/abg_lite_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d8bb62feaca29c6331af00715eb59493562b5213706522a97cd6ada5e8316313 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:39:54 GMT content-encoding gzip x-content-type-options nosniff age 9415 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7894 x-xss-protection 0 server cafe etag 10405968765291005445 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:39:54 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame FE21	2 KB 1 KB	10ms 9ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:39:49 GMT content-encoding gzip x-content-type-options nosniff age 9420 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1210 x-xss-protection 0 server cafe etag 9753579932288205849 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:39:49 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame FE21	119 KB 36 KB	77ms 62ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:49 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame FE21	15 KB 6 KB	9ms 8ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:39:49 GMT content-encoding gzip x-content-type-options nosniff age 9420 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6485 x-xss-protection 0 server cafe etag 13366392639478751132 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:39:49 GMT
GET H3	200	6d065ef8aad4e53a06604e1059b7b7b3.js Show response www.gstatic.com/mysidia/ Frame FE21	27 KB 11 KB	10ms 9ms	Script text/javascript	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/mysidia/6d065ef8aad4e53a06604e1059b7b7b3.js?tag=mysidia_one_click_handler_one_afma_2019 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b138f0b28fe44581bebb03d0ff7046e4f8416deeb5d152ede640eaa3dc1c7872 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 22:16:39 GMT content-encoding gzip x-content-type-options nosniff age 158410 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11408 x-xss-protection 0 last-modified Mon, 06 Dec 2021 07:52:38 GMT server sffe cross-origin-opener-policy same-origin; report-to="mysidia" vary Accept-Encoding report-to {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]} content-type text/javascript cache-control public, max-age=7776000 accept-ranges bytes expires Sun, 03 Apr 2022 22:16:39 GMT
GET DATA	200 OK	truncated / Frame 9451	217 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 9eec89a385aea3e2d5f8f21b34b9671403f582f9499b11d2b09a82987ef66011 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H2	200	4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame 9451	21 KB 21 KB	36ms 13ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://googleads.g.doubleclick.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 10:56:24 GMT x-content-type-options nosniff age 112825 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21660 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:07:18 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 04 Jan 2023 10:56:24 GMT
GET H2	200	4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame 9451	21 KB 22 KB	28ms 7ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://googleads.g.doubleclick.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 20:07:29 GMT x-content-type-options nosniff age 79760 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21424 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:08:24 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 04 Jan 2023 20:07:29 GMT
GET H3	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/1232669750904781805/ Frame FE21	17 KB 18 KB	9ms 8ms	Image image/jpeg	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/1232669750904781805/downsize_200k_v1?w=600&h=314 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 9d86057ec95daa14e0e85357c82da67de72abda65bfb191eb3d50c7419e6d750 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 31 Dec 2021 15:41:04 GMT x-content-type-options nosniff age 441345 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 17899 x-xss-protection 0 last-modified Fri, 10 Dec 2021 20:35:00 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Sat, 31 Dec 2022 15:41:04 GMT
GET DATA	200 OK	truncated / Frame FE21	209 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 0cc7088b335b30f7b1fa0903bc8aa143b11cb8408032d62d28d5ab768cc68c88 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET H3	200	adview googleads.g.doubleclick.net/pagead/ Frame FE21	0 0	51ms 50ms	Fetch text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/adview?ai=CoO4dkODVYYmfE4iD9fgP48q1uALihvqTZ53NioD7DpyfiN7MJBABIPOR8SJguwagAaaJ64wDyAEJqAMByAPLBKoEkgJP0EjzjUQqYufDc_NdWX6JwPdNhX-hNtglGwQTv7MqJdTZFHDnIltiqlokCEGY5HdV4n3hk-Ep-S5N2dRfWBU1DiNhgjqt6DH1Eb5j2H-7_aw0oU-3EfYLydAniScPm_pfVeQV2aOxYRtNSI47rYn3bc3LbTH5XzN1MRVf54poeQlfzE1q-yNkpSHlPTdL7MR-Ms2_Tq9IxNvcZQwjzG-poSDMksxz8ESluY2ulvC1Y1wq0v5t3H57TRskIzHf7I04V4Am8HCFS6MtVCK5laKgNcQoduxy4F8CvFzTCK2yZEnUJLn1qSnPpdLjKKwv-XBH61aVYzsmczxwM0_BkFr4N23alzt6A5-MaHCjfU2xHnOIwATg1-SRgQSSBQQIBBgBkgUECAUYBKAGLoAH-_PO4QGoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBDJ7AXSCAkIgOGAEBABGB-ACgHICwG4E4gn2BMN0BUBgBcBshccChoIABIUcHViLTQ4NTEyMzIwNjc4OTg4MzEYAA&sigh=Lx1DmjXGCY8&uach_m=[UACH]&template_id=5000 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe date Wed, 05 Jan 2022 18:16:49 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3	200	css fonts.googleapis.com/ Frame 1061	3 KB 579 B	17ms 17ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 05 Jan 2022 18:15:44 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 05 Jan 2022 18:16:49 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	load_preloaded_resource_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 1061	1 KB 880 B	7ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/load_preloaded_resource_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:40:07 GMT content-encoding gzip x-content-type-options nosniff age 9402 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 853 x-xss-protection 0 server cafe etag 7170004918125193417 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:40:07 GMT
GET H3	200	abg_lite_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/ Frame 1061	19 KB 8 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/abg_lite_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d8bb62feaca29c6331af00715eb59493562b5213706522a97cd6ada5e8316313 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:39:54 GMT content-encoding gzip x-content-type-options nosniff age 9415 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7894 x-xss-protection 0 server cafe etag 10405968765291005445 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:39:54 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 1061	2 KB 1 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/window_focus_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 3a00a06d39ece4f2816e75b2e577c3b05a51ba196e19bd103d1124567f0c54f5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:39:49 GMT content-encoding gzip x-content-type-options nosniff age 9420 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1210 x-xss-protection 0 server cafe etag 9753579932288205849 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:39:49 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 1061	119 KB 36 KB	32ms 31ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:49 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/ Frame 1061	15 KB 6 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20220104/r20110914/client/qs_click_protection_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e979dfe4d55dc019e062fbce71ec0821c8abeabd94f7490deedf56ee2712d2ba Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 15:39:49 GMT content-encoding gzip x-content-type-options nosniff age 9420 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6485 x-xss-protection 0 server cafe etag 13366392639478751132 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 15:39:49 GMT
GET H3	200	6d065ef8aad4e53a06604e1059b7b7b3.js Show response www.gstatic.com/mysidia/ Frame 1061	27 KB 11 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/mysidia/6d065ef8aad4e53a06604e1059b7b7b3.js?tag=mysidia_one_click_handler_one_afma_2019 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/html/r20211207/r20110914/zrt_lookup.html?fsb=1 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b138f0b28fe44581bebb03d0ff7046e4f8416deeb5d152ede640eaa3dc1c7872 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 22:16:39 GMT content-encoding gzip x-content-type-options nosniff age 158410 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11408 x-xss-protection 0 last-modified Mon, 06 Dec 2021 07:52:38 GMT server sffe cross-origin-opener-policy same-origin; report-to="mysidia" vary Accept-Encoding report-to {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]} content-type text/javascript cache-control public, max-age=7776000 accept-ranges bytes expires Sun, 03 Apr 2022 22:16:39 GMT
GET DATA	200 OK	truncated / Frame FE21	214 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ed45831da7ad5ac9626cc2f270d311fd229ed2d5c81759049fdd08adaf735136 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H3	200	EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response pagead2.googlesyndication.com/bg/ Frame BC34	35 KB 13 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=7635002467&adk=1459884512&adf=3119996176&pi=t.ma~as.7635002467&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608146&bpp=2&bdt=186&idt=113&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=70&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=2&uci=a!2&fsb=1&xpc=DQ9vm0omLC&p=https%3A//steprimo.com&dtd=117 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 11:58:52 GMT content-encoding br x-content-type-options nosniff age 22677 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13555 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 05 Jan 2023 11:58:52 GMT
GET H3	200	4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame FE21	21 KB 21 KB	21ms 7ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://googleads.g.doubleclick.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 10:56:24 GMT x-content-type-options nosniff age 112825 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21660 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:07:18 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 04 Jan 2023 10:56:24 GMT
GET H3	200	4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame FE21	21 KB 21 KB	23ms 9ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://googleads.g.doubleclick.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 20:07:29 GMT x-content-type-options nosniff age 79760 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21424 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:08:24 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 04 Jan 2023 20:07:29 GMT
GET H3	200	EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response pagead2.googlesyndication.com/bg/ Frame DC1F	35 KB 13 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&slotname=1930387240&adk=2473048226&adf=1861988969&pi=t.ma~as.1930387240&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608148&bpp=1&bdt=189&idt=132&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C1200x280&nras=1&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=741&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&ifi=3&uci=a!3&fsb=1&xpc=TdIpFHFJ5R&p=https%3A//steprimo.com&dtd=135 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 11:58:52 GMT content-encoding br x-content-type-options nosniff age 22677 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13555 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 05 Jan 2023 11:58:52 GMT
GET H3	200	EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response pagead2.googlesyndication.com/bg/ Frame D7FD	35 KB 13 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 11:58:52 GMT content-encoding br x-content-type-options nosniff age 22677 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13555 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 05 Jan 2023 11:58:52 GMT
GET H3	200	de974e0de653beaf8b7a147538108e14.js Show response www.gstatic.com/mysidia/ Frame CEB6	8 KB 3 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/mysidia/de974e0de653beaf8b7a147538108e14.js?tag=client_fast_engine_2019 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c9a70686ad065d96298301b1fe7daf4199a4e72348dd638330390f7763ae226b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 23:26:37 GMT content-encoding gzip x-content-type-options nosniff age 154212 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3353 x-xss-protection 0 last-modified Mon, 06 Dec 2021 07:52:38 GMT server sffe cross-origin-opener-policy same-origin; report-to="mysidia" vary Accept-Encoding report-to {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]} content-type text/javascript cache-control public, max-age=7776000 accept-ranges bytes expires Sun, 03 Apr 2022 23:26:37 GMT
GET H3	200	ef71563f30928051bf5f5d97e506b840.js Show response www.gstatic.com/mysidia/ Frame CEB6	8 KB 4 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/mysidia/ef71563f30928051bf5f5d97e506b840.js?tag=text/vanilla_highlight Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 63cb35133865eac473826f95c6a9d64ff1fa3da71403ea4f1981e5de9bcd69bd Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 23:26:37 GMT content-encoding gzip x-content-type-options nosniff age 154212 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3802 x-xss-protection 0 last-modified Mon, 06 Dec 2021 07:52:38 GMT server sffe cross-origin-opener-policy same-origin; report-to="mysidia" vary Accept-Encoding report-to {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]} content-type text/javascript cache-control public, max-age=7776000 accept-ranges bytes expires Sun, 03 Apr 2022 23:26:37 GMT
GET H3	200	css fonts.googleapis.com/ Frame CEB6	3 KB 622 B	15ms 15ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Open%20Sans%3A400 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash c99361c0d8561c7d88a237009bac83ecc149fe6f1f91c52dde79b7841b584c40 Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 05 Jan 2022 18:15:51 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 05 Jan 2022 18:16:49 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	load_preloaded_resource_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame CEB6	1 KB 880 B	7ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/load_preloaded_resource_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:12:14 GMT content-encoding gzip x-content-type-options nosniff age 275 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 853 x-xss-protection 0 server cafe etag 7170004918125193417 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:12:14 GMT
GET H3	200	abg_lite_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame CEB6	19 KB 8 KB	6ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:05:54 GMT content-encoding gzip x-content-type-options nosniff age 655 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7876 x-xss-protection 0 server cafe etag 5333878705136318229 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:05:54 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame CEB6	2 KB 1 KB	8ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:15:42 GMT content-encoding gzip x-content-type-options nosniff age 67 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:15:42 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame CEB6	119 KB 36 KB	22ms 22ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:49 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame CEB6	15 KB 6 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:12:28 GMT content-encoding gzip x-content-type-options nosniff age 261 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6464 x-xss-protection 0 server cafe etag 15715955993838318253 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:12:28 GMT
GET H3	200	6d065ef8aad4e53a06604e1059b7b7b3.js Show response www.gstatic.com/mysidia/ Frame CEB6	27 KB 11 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/mysidia/6d065ef8aad4e53a06604e1059b7b7b3.js?tag=mysidia_one_click_handler_one_afma_2019 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b138f0b28fe44581bebb03d0ff7046e4f8416deeb5d152ede640eaa3dc1c7872 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 22:16:39 GMT content-encoding gzip x-content-type-options nosniff age 158410 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11408 x-xss-protection 0 last-modified Mon, 06 Dec 2021 07:52:38 GMT server sffe cross-origin-opener-policy same-origin; report-to="mysidia" vary Accept-Encoding report-to {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]} content-type text/javascript cache-control public, max-age=7776000 accept-ranges bytes expires Sun, 03 Apr 2022 22:16:39 GMT
GET H3	200	B25303455.319684981;dc_pre=CK2kmY-cm_UCFWbIuwgdFUwBww;dc_trk_aid=512113641;dc_trk_cid=161273136;ord=3497425785;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd= Show response ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/ Frame CEB6 Redirect Chain https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B25303455.319684981;dc_trk_aid=512113641;dc_trk_cid=161273136;ord=3497425785;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr... https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B25303455.319684981;dc_pre=CK2kmY-cm_UCFWbIuwgdFUwBww;dc_trk_aid=512113641;dc_trk_cid=161273136;ord=3497425785;dc_lat=;dc_rdid=;tag_for_ch...	42 B 63 B	46ms 30ms	Fetch image/gif	142.250.184.198 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B25303455.319684981;dc_pre=CK2kmY-cm_UCFWbIuwgdFUwBww;dc_trk_aid=512113641;dc_trk_cid=161273136;ord=3497425785;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=? Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Server 142.250.184.198 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f6.1e100.net Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 location https://ad.doubleclick.net/ddm/trackimp/N718679.3159GOOGLE/B25303455.319684981;dc_pre=CK2kmY-cm_UCFWbIuwgdFUwBww;dc_trk_aid=512113641;dc_trk_cid=161273136;ord=3497425785;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;gdpr=;gdpr_consent=;ltd=? cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin follow-only-when-prerender-shown 1 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	adview googleads.g.doubleclick.net/pagead/ Frame CEB6	0 0	50ms 49ms	Fetch text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/adview?ai=CYYcpkeDVYf_ZBIuJgQPjyZXAB_vr9tJjxt6LxIYPrgIQASDzkfEiYLsGoAHS-MviA8gBAagDAcgDywSqBJACT9DcabzFWFqRkurTIkeO_pCcjiEg4FwsjBLXS8-VzMzbawk6N2IAJilbVDFcKnCr6x-Zf-e6lkO970AKW14cmgWxSz7iJGzMOHhW2NyVFSb_EsEJfd5MJuB0RX4IwTeHL0dkr-vxW3IRXS3-DijLLafwqg8zFDLT30mqRsi8U7LWvnP9ytITbwLuF2BMZdPv-MaCLQDa75oUQD0gAPeBGAhuM4XNhY1JWdqw_H-GiJochzCsgPb6Y6ICg9vRqP62TZvBrShXx3H5n4kRKmLTsacFUdRWnejX6azhi--MpnlX2QTVn0EkCDixtqM85xwRy2HriofTsj9q9cfKzQJrTgZd7CE0-9-krv7w4PpCxcvABPWG9oKDAoAHgYjWQ6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcDEMRr0ggJCIDhgBAQARgfgAoByAsB2BMD0BUBgBcBshccChoIABIUcHViLTQ4NTEyMzIwNjc4OTg4MzEYAA&sigh=HA6Nk4wSF1k&uach_m=[UACH] Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe date Wed, 05 Jan 2022 18:16:49 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3	200	s Show response googleads.g.doubleclick.net/pagead/drt/ Frame 2FE2	143 B 163 B	8ms 6ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Response headers content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip date Wed, 05 Jan 2022 18:02:27 GMT server cafe content-length 145 x-xss-protection 0 cache-control public, max-age=3600 age 862 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	cookie_push_onload.html Show response pagead2.googlesyndication.com/pagead/s/ Frame CECA	1 KB 749 B	8ms 7ms	Document text/html	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ Response headers p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" timing-allow-origin * cross-origin-resource-policy cross-origin vary Accept-Encoding date Wed, 05 Jan 2022 13:26:12 GMT expires Thu, 06 Jan 2022 13:26:12 GMT content-type text/html; charset=UTF-8 etag 48472445140208031 x-content-type-options nosniff content-encoding gzip server cafe content-length 724 x-xss-protection 0 age 17437 cache-control public, max-age=86400 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET DATA	200 OK	truncated / Frame CEB6	208 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d43aaba724415dac98798c8f4eaaf3ebc7991f6963e99424659113b8f17f9722 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H3	200	memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 fonts.gstatic.com/s/opensans/v27/ Frame CEB6	16 KB 16 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/opensans/v27/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVI.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Open%20Sans%3A400 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash cce577471c2586f3e0c2518fff84a970d33f61491fb8c629341b86f238cf07c0 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://googleads.g.doubleclick.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Fri, 31 Dec 2021 06:37:09 GMT x-content-type-options nosniff age 473980 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 16692 x-xss-protection 0 last-modified Thu, 28 Oct 2021 00:32:10 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Sat, 31 Dec 2022 06:37:09 GMT
GET H3	200	css fonts.googleapis.com/ Frame FCC5	3 KB 579 B	15ms 15ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 05 Jan 2022 18:10:52 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 05 Jan 2022 18:16:49 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	load_preloaded_resource_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame FCC5	1 KB 880 B	7ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/load_preloaded_resource_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash b4a25f11fbb1e2b547eaf848472f9c048824e307a945f3a0417aac7b09d0456e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:12:14 GMT content-encoding gzip x-content-type-options nosniff age 275 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 853 x-xss-protection 0 server cafe etag 7170004918125193417 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:12:14 GMT
GET H3	200	abg_lite_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/ Frame FCC5	19 KB 8 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/abg_lite_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash d9955b485ec10339d863941175c02572657bf9d4f6c5fa2e5603e7d803c1b8cf Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:05:54 GMT content-encoding gzip x-content-type-options nosniff age 655 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7876 x-xss-protection 0 server cafe etag 5333878705136318229 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:05:54 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame FCC5	2 KB 1 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:15:42 GMT content-encoding gzip x-content-type-options nosniff age 67 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:15:42 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame FCC5	119 KB 36 KB	17ms 17ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:49 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame FCC5	15 KB 6 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:12:28 GMT content-encoding gzip x-content-type-options nosniff age 261 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6464 x-xss-protection 0 server cafe etag 15715955993838318253 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:12:28 GMT
GET H2	204	l www.google.com/ads/measurement/ Frame FCC5	0 0	37ms 14ms	Image text/html	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaRHyvrUQ80u2FTQ8TQM2dsfoV74hFAJAsg653uylTbTZL33fkp_7uy-ER-0NqSs_9FYGQGw_giujQMkQKfZ9pFwdtzgJA Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
GET H3	200	6d065ef8aad4e53a06604e1059b7b7b3.js Show response www.gstatic.com/mysidia/ Frame FCC5	27 KB 11 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:809::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/mysidia/6d065ef8aad4e53a06604e1059b7b7b3.js?tag=mysidia_one_click_handler_one_afma_2019 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b138f0b28fe44581bebb03d0ff7046e4f8416deeb5d152ede640eaa3dc1c7872 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Mon, 03 Jan 2022 22:16:39 GMT content-encoding gzip x-content-type-options nosniff age 158410 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 11408 x-xss-protection 0 last-modified Mon, 06 Dec 2021 07:52:38 GMT server sffe cross-origin-opener-policy same-origin; report-to="mysidia" vary Accept-Encoding report-to {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]} content-type text/javascript cache-control public, max-age=7776000 accept-ranges bytes expires Sun, 03 Apr 2022 22:16:39 GMT
GET H3	200	adview googleads.g.doubleclick.net/pagead/ Frame FCC5	0 0	49ms 49ms	Fetch text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/adview?ai=Cz_q7kODVYaXvOdbdbbqXufAOreGbvWSuoLnvlQir2ZuL0BkQASDzkfEiYLsGoAHv9Iv3AsgBCagDAcgDywSqBJICT9DhVKIpR00VWwX6yksiK43c91NxRCIK7bG-MYRklvBEdYvzf4M-rWG1IKAyOmF3YOiIv7pfU8dnVBlfnEuspI1NuQkLdE_Hd7-pKiJ9rMSuJ-PHUj0ZqeIgrOAXfGm35z4-2FgIbVVF6EFAMESSKRk6HNqP7FtuUmVgCnm9vsjZ2C-E_Fefh_J0y-5tRNMIaOiLrHGgAxqxzYqClWhH6R2Bw_hon6VmalTsJbdnXY-txf-RRdZouxlhKuLNPjACKSRLPs2aZGMmeN_ZSQOfkiwThOFYJcjGhI7b8j7W-DlKHVL1MGmbPzHhvvkobftgqgbTRK2N-zuuoJPAuQyU_4w-Ku8vBlf_Yf2R9CcR-n2aLcAE1_r63ekBkgUECAQYAZIFBAgFGASgBi6AB_mK9IgBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwDyBwQQvukH0ggJCIDhgBAQARgfgAoByAsBuBOIJ9gTDYgUBdAVAYAXAbIXHAoaCAASFHB1Yi00ODUxMjMyMDY3ODk4ODMxGAA&sigh=yPlCMXxP_t0&uach_m=[UACH]&template_id=5000 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe date Wed, 05 Jan 2022 18:16:49 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3	200	downsize_200k_v1 tpc.googlesyndication.com/simgad/8462491575779576454/ Frame FCC5	73 KB 73 KB	8ms 7ms	Image image/png	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/simgad/8462491575779576454/downsize_200k_v1?w=600&h=314 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 6ec8155772754591c80ab9afe4971581bb32733bd4eb77953fe7213046edc5fe Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Thu, 30 Dec 2021 14:08:10 GMT x-content-type-options nosniff age 533319 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 74956 x-xss-protection 0 last-modified Sun, 18 Nov 2018 23:43:49 GMT server sffe report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Fri, 30 Dec 2022 14:08:10 GMT
GET DATA	200 OK	truncated / Frame FCC5	209 B 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash d7779d95203bed5280ee3281f856607f95ac5df680547356656c7109d7d0a6a6 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	dpixel cms.quantserve.com/ Frame CECA	35 B 464 B	45ms 11ms	Image image/gif	2620:116:800d:21:3175:5196:e3fd:8c1d AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESECOQrkXMQS539iGU0IYiK9w&google_cver=1&google_push=AYg5qPKYOPu_sabTmwkOe5GQc7tdO3rsioePnn8cBNIonMiAPcwgi4NZ6iVoQGr69MXkw6l8Sd6jWKYx5YsQFYqMJl0uMME2Dn4 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:3175:5196:e3fd:8c1d , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT strict-transport-security max-age=86400 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" cache-control private, no-cache, no-store, proxy-revalidate content-type image/gif content-length 35 expires Fri, 04 Aug 1978 12:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame CECA Redirect Chain https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPKMVo-6d6B3TR2xGaJuhdCtAflvnavqL-YIVSM... https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWRYZ2tRQUFBWEtyQGh5YQ&google_push=AYg5qPKMVo-6d6B3TR2xGaJuhdCtAflvnavqL-YIVSMTpbtviyz64wbKy3bZmCTfsCLts-F26KJgaNxVS_c1_SROzjN9oaxNMGM	170 B 188 B	16ms 16ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWRYZ2tRQUFBWEtyQGh5YQ&google_push=AYg5qPKMVo-6d6B3TR2xGaJuhdCtAflvnavqL-YIVSMTpbtviyz64wbKy3bZmCTfsCLts-F26KJgaNxVS_c1_SROzjN9oaxNMGM Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Location https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWRYZ2tRQUFBWEtyQGh5YQ&google_push=AYg5qPKMVo-6d6B3TR2xGaJuhdCtAflvnavqL-YIVSMTpbtviyz64wbKy3bZmCTfsCLts-F26KJgaNxVS_c1_SROzjN9oaxNMGM Date Wed, 05 Jan 2022 18:16:49 GMT Server Apache Connection keep-alive Content-Length 390 Content-Type text/html; charset=iso-8859-1
GET H3	200	pixel cm.g.doubleclick.net/ Frame CECA Redirect Chain https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESENnqmYqEVQafuLPXtuDp7-Y&google_push=AYg5qPJm0nfMIXLzY-U1SA3ntgxQ3IvcGVQQVWZtUVhE7vIGmK8Y1LDUEnvasSaawWMfhCfA2MLXEdloCqwL4yCeoxJNr4l... https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPJm0nfMIXLzY-U1SA3ntgxQ3IvcGVQQVWZtUVhE7vIGmK8Y1LDUEnvasSaawWMfhCfA2MLXEdloCqwL4yCeoxJNr4lZ06E&google_hm=MTA4MTY4MDE4ODEyMDc...	170 B 188 B	16ms 16ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPJm0nfMIXLzY-U1SA3ntgxQ3IvcGVQQVWZtUVhE7vIGmK8Y1LDUEnvasSaawWMfhCfA2MLXEdloCqwL4yCeoxJNr4lZ06E&google_hm=MTA4MTY4MDE4ODEyMDc1MTYxNzc Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT via 1.1 google server Apache p3p CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml" location https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPJm0nfMIXLzY-U1SA3ntgxQ3IvcGVQQVWZtUVhE7vIGmK8Y1LDUEnvasSaawWMfhCfA2MLXEdloCqwL4yCeoxJNr4lZ06E&google_hm=MTA4MTY4MDE4ODEyMDc1MTYxNzc cache-control no-cache, no-store, must-revalidate alt-svc clear content-length 0 x-application-context application expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	dds rtb.openx.net/sync/ Frame CECA	43 B 350 B	38ms 21ms	Image image/gif	35.186.253.211 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://rtb.openx.net/sync/dds?google_gid=CAESEAPjg0Z8gkxFXADHQZmKCPo&google_cver=1&google_push=AYg5qPL6GE8y8fCO5o0OaLIK_kjkBr_NbA_CmD7AGZRr6-uLEv9UPgKagmLx0Bf0qeRsD5pO21zA_qcVRNW_YMvgQOmERATBEyk Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 211.253.186.35.bc.googleusercontent.com Software Cowboy / Resource Hash 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT via 1.1 google server Cowboy vary Origin p3p CP="CUR ADM OUR NOR STA NID" access-control-allow-origin null access-control-expose-headers cache-control private, max-age=0, no-cache, must-revalidate access-control-allow-credentials true content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 43 x-request-id 6lo8u2a2o45b624927c467q6ovfa9164
GET H3	200	pixel cm.g.doubleclick.net/ Frame CECA Redirect Chain https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%... https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%... https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=3pJ686REStSqw_ySDZw4bg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...	170 B 188 B	18ms 17ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=3pJ686REStSqw_ySDZw4bg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKA4gqFTwWpXgsBbyydcJ70AFj6i0gsFeoVa2mzOlHEIGPr1R0lJYtbyHq1Hs5LunOrnOmBZ4wr08aLRl2jPmoBMb3z3U4 Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers location https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=3pJ686REStSqw_ySDZw4bg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKA4gqFTwWpXgsBbyydcJ70AFj6i0gsFeoVa2mzOlHEIGPr1R0lJYtbyHq1Hs5LunOrnOmBZ4wr08aLRl2jPmoBMb3z3U4 date Wed, 05 Jan 2022 18:16:48 GMT p3p CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" content-length 0 content-type text/html; charset=UTF-8
GET H3	200	pixel cm.g.doubleclick.net/ Frame CECA Redirect Chain https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEPbBQeztdNBI49Brr5a3W1E&google_cver=1&google_push=AYg5qPLA-54JxpQdc6vbyvfNvx0_04SI3kY06h36__empa1xQVDRmB8jQzLKIy2tXG3yYSprkx-... https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1kxVjQ1UjUtRy1INU0=&google_push=AYg5qPLA-54JxpQdc6vbyvfNvx0_04SI3kY06h36__empa1xQVDRmB8jQzLKIy2tXG3yYSprkx-ugSEfsSnMaRc_SGlGKmQz7rs	170 B 188 B	32ms 17ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1kxVjQ1UjUtRy1INU0=&google_push=AYg5qPLA-54JxpQdc6vbyvfNvx0_04SI3kY06h36__empa1xQVDRmB8jQzLKIy2tXG3yYSprkx-ugSEfsSnMaRc_SGlGKmQz7rs Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Pragma no-cache P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Location https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1kxVjQ1UjUtRy1INU0=&google_push=AYg5qPLA-54JxpQdc6vbyvfNvx0_04SI3kY06h36__empa1xQVDRmB8jQzLKIy2tXG3yYSprkx-ugSEfsSnMaRc_SGlGKmQz7rs Cache-Control no-cache,no-store,must-revalidate Content-Type text/html content-length 0 X-RPHost 611afce88997db6fdd35eb213e662871 Expires 0
GET		pixel cm.g.doubleclick.net/ Frame CECA Redirect Chain https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&googl... https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_push=AY... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwj...	0 0
GET H2	204	attr cm.g.doubleclick.net/pixel/ Frame CECA	0 223 B	37ms 14ms	Image text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KuRkZWaBofQJdaQMuwndsJksUty51vMujdxZ7v2FmvH1h3TjjnAZNzv_tpIknRZBHbGfBn Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 content-type text/html
GET H3	200	si Show response googleads.g.doubleclick.net/pagead/drt/ Frame 2FE2 Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	0 16 B	70ms 69ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211 Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 x-content-type-options nosniff date Wed, 05 Jan 2022 18:16:49 GMT server cafe content-length 0 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 05 Jan 2022 18:16:49 GMT cache-control private Redirect headers location https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA cache-control private content-type text/html; charset=UTF-8 x-content-type-options nosniff date Wed, 05 Jan 2022 18:16:49 GMT server cafe content-length 0 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response pagead2.googlesyndication.com/bg/ Frame E451	35 KB 13 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=50&adk=3573649038&adf=1981190670&pi=t.aa~a.2302584692~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x50&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=0&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280%2C1190x90&nras=4&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=2039&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=6&uci=a!6&btvi=3&fsb=1&xpc=ua0GfNnEnh&p=https%3A//steprimo.com&dtd=15 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 11:58:52 GMT content-encoding br x-content-type-options nosniff age 22677 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13555 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 05 Jan 2023 11:58:52 GMT
GET H3	200	cookie_push_onload.html Show response pagead2.googlesyndication.com/pagead/s/ Frame B5DF	1 KB 749 B	6ms 6ms	Document text/html	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ Response headers p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" timing-allow-origin * cross-origin-resource-policy cross-origin vary Accept-Encoding date Wed, 05 Jan 2022 13:26:12 GMT expires Thu, 06 Jan 2022 13:26:12 GMT content-type text/html; charset=UTF-8 etag 48472445140208031 x-content-type-options nosniff content-encoding gzip server cafe content-length 724 x-xss-protection 0 age 17437 cache-control public, max-age=86400 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET DATA	200 OK	truncated / Frame FCC5	212 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash e256389d8cda1ed870ecaa7868018aa2d0fff39b65e2a8cffa31670d574c0ffa Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H3	200	4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame FCC5	21 KB 21 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UabrENHsxJlGDuGo1OIlLU94YtzCwY.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 1abc5469f1235e85489ca1062a07fe18c7f449e3ba039d3de0da07fbb3c5892d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://googleads.g.doubleclick.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 10:56:24 GMT x-content-type-options nosniff age 112825 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21660 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:07:18 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 04 Jan 2023 10:56:24 GMT
GET H3	200	4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 fonts.gstatic.com/s/googlesans/v36/ Frame FCC5	21 KB 21 KB	8ms 8ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/googlesans/v36/4UaGrENHsxJlGDuGo1OIlL3Owp4.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c55eebd9845964c111ecdbe7e583ed00ff47536f13c46a7e9c70430cc7ea091f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://googleads.g.doubleclick.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 20:07:29 GMT x-content-type-options nosniff age 79760 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 21424 x-xss-protection 0 last-modified Wed, 01 Sep 2021 18:08:24 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 04 Jan 2023 20:07:29 GMT
GET H2	200	dpixel cms.quantserve.com/ Frame B5DF	35 B 210 B	10ms 9ms	Image image/gif	2620:116:800d:21:3175:5196:e3fd:8c1d AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEI9oQWwjLrxPf8CYrr4yPf8&google_cver=1&google_push=AYg5qPJ-EN8i5kodjAtrP0Nh0C4fzOVMyUWXmBOKKvlQYxwzW8TEXEyGSuXe3bUNIa9M05M91YH1Ro7WjSuu8uHyod0CJl7JqQS5 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:3175:5196:e3fd:8c1d , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT cache-control private, no-cache, no-store, proxy-revalidate content-type image/gif content-length 35 strict-transport-security max-age=86400 expires Fri, 04 Aug 1978 12:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame B5DF Redirect Chain https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPI5wTzi72eM4tLpIHUYj0296cIjzMDStySoSid... https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWRYZ2tRQUFCWlhNMkc2aA&google_push=AYg5qPI5wTzi72eM4tLpIHUYj0296cIjzMDStySoSidbQV6y8R_dAD4aW_uJ4m0K5b9E0tocTMZW1sEJiizS0CUVPTyyweO1MdCN	170 B 188 B	16ms 16ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWRYZ2tRQUFCWlhNMkc2aA&google_push=AYg5qPI5wTzi72eM4tLpIHUYj0296cIjzMDStySoSidbQV6y8R_dAD4aW_uJ4m0K5b9E0tocTMZW1sEJiizS0CUVPTyyweO1MdCN Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Location https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWRYZ2tRQUFCWlhNMkc2aA&google_push=AYg5qPI5wTzi72eM4tLpIHUYj0296cIjzMDStySoSidbQV6y8R_dAD4aW_uJ4m0K5b9E0tocTMZW1sEJiizS0CUVPTyyweO1MdCN Date Wed, 05 Jan 2022 18:16:49 GMT Server Apache Connection keep-alive Content-Length 391 Content-Type text/html; charset=iso-8859-1
GET H3	200	pixel cm.g.doubleclick.net/ Frame B5DF Redirect Chain https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLAZE2p... https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPLAZE2p... https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMDUxODE2NTAwMDAyMTMxNTQ4NjU4MQ%3D%3D&google_push=AYg5qPLAZE2p5I4xqd9tj4rn4OoLtwg6M6yaqAchV65XDKEn9ge3AqZQTgQz-77LwdcQCd...	170 B 188 B	16ms 16ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMDUxODE2NTAwMDAyMTMxNTQ4NjU4MQ%3D%3D&google_push=AYg5qPLAZE2p5I4xqd9tj4rn4OoLtwg6M6yaqAchV65XDKEn9ge3AqZQTgQz-77LwdcQCdpUkiiuq8c8xhWRlGdRdTTfiHiAF_4v Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:50 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers location https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjAxMDUxODE2NTAwMDAyMTMxNTQ4NjU4MQ%3D%3D&google_push=AYg5qPLAZE2p5I4xqd9tj4rn4OoLtwg6M6yaqAchV65XDKEn9ge3AqZQTgQz-77LwdcQCdpUkiiuq8c8xhWRlGdRdTTfiHiAF_4v pragma no-cache date Wed, 05 Jan 2022 18:16:50 GMT cache-control max-age=0, no-cache, no-store content-length 0 strict-transport-security max-age=2628000 expires Wed, 05 Jan 2022 18:16:50 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame B5DF Redirect Chain https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEKv1enKGW1enfYqoXAlN4dI&google_push=AYg5qPLvNILmakpo39PNKlAMqNqNj0gACpds9gjBlH6WOnBYhKaZkpCXizsg0hmTI7kCc2ujX7dYptpZ9gI5JIFvQkXgDG7... https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPLvNILmakpo39PNKlAMqNqNj0gACpds9gjBlH6WOnBYhKaZkpCXizsg0hmTI7kCc2ujX7dYptpZ9gI5JIFvQkXgDG7pkUog&google_hm=MTA4MTY4MDE4ODEyMD...	170 B 188 B	24ms 23ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPLvNILmakpo39PNKlAMqNqNj0gACpds9gjBlH6WOnBYhKaZkpCXizsg0hmTI7kCc2ujX7dYptpZ9gI5JIFvQkXgDG7pkUog&google_hm=MTA4MTY4MDE4ODEyMDc1MTYxNzc Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT via 1.1 google server Apache p3p CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml" location https://cm.g.doubleclick.net/pixel?google_nid=xaxis_dmp&google_push=AYg5qPLvNILmakpo39PNKlAMqNqNj0gACpds9gjBlH6WOnBYhKaZkpCXizsg0hmTI7kCc2ujX7dYptpZ9gI5JIFvQkXgDG7pkUog&google_hm=MTA4MTY4MDE4ODEyMDc1MTYxNzc cache-control no-cache, no-store, must-revalidate alt-svc clear content-length 0 x-application-context application expires Thu, 01 Jan 1970 00:00:00 GMT
GET H3	200	pixel cm.g.doubleclick.net/ Frame B5DF Redirect Chain https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%... https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=GsrZ1fdtROSB_o50ZepW5w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...	170 B 188 B	17ms 17ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=GsrZ1fdtROSB_o50ZepW5w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIN0oGbaj6bul1IGdGcIwRp_w2a15aRQTHQAdfFLb6QwTfg13Nge3wtelbxEWEXvRZmHty43kVtocRxg9SZoMLIOVO6mrLb Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers location https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=GsrZ1fdtROSB_o50ZepW5w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPIN0oGbaj6bul1IGdGcIwRp_w2a15aRQTHQAdfFLb6QwTfg13Nge3wtelbxEWEXvRZmHty43kVtocRxg9SZoMLIOVO6mrLb date Wed, 05 Jan 2022 18:16:49 GMT p3p CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC" content-length 0 content-type text/html; charset=UTF-8
GET H3	200	pixel cm.g.doubleclick.net/ Frame B5DF Redirect Chain https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHdDd_JOSBGziI5tD9CnzCI&google_cver=1&google_push=AYg5qPLqTWtJoibUItfkqlQt1F1lSpF1V1D5EQJrTkg6vmIcC0qC80FXlQ6SgZM6WnVftBEhbSK... https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1kxVjQ1VDctVC1FS1BJ&google_push=AYg5qPLqTWtJoibUItfkqlQt1F1lSpF1V1D5EQJrTkg6vmIcC0qC80FXlQ6SgZM6WnVftBEhbSKOz05VIUfHBJD48F9TT0_ss9AH	170 B 188 B	19ms 19ms	Image image/png	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1kxVjQ1VDctVC1FS1BJ&google_push=AYg5qPLqTWtJoibUItfkqlQt1F1lSpF1V1D5EQJrTkg6vmIcC0qC80FXlQ6SgZM6WnVftBEhbSKOz05VIUfHBJD48F9TT0_ss9AH Requested by Host: steprimo.com URL: https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Protocol H3 Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash 0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) content-type image/png cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 170 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers Pragma no-cache P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Location https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1kxVjQ1VDctVC1FS1BJ&google_push=AYg5qPLqTWtJoibUItfkqlQt1F1lSpF1V1D5EQJrTkg6vmIcC0qC80FXlQ6SgZM6WnVftBEhbSKOz05VIUfHBJD48F9TT0_ss9AH Cache-Control no-cache,no-store,must-revalidate Content-Type text/html content-length 0 X-RPHost 611afce88997db6fdd35eb213e662871 Expires 0
GET		pixel cm.g.doubleclick.net/ Frame B5DF Redirect Chain https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA&google_cver=1&googl... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa... https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa...	0 0
GET H3	204	attr cm.g.doubleclick.net/pixel/ Frame B5DF	0 12 B	19ms 18ms	Image text/html	142.250.185.66 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IhYYhfn4Zb6yuHO08ofpfIUt7iGRb2EZbR591rF-3akvW2dQqKqiL4B8i0OW2je_dtpqJp Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.66 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f2.1e100.net Software HTTP server (unknown) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pagead2.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:49 GMT server HTTP server (unknown) alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 content-type text/html
GET H3	200	EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response pagead2.googlesyndication.com/bg/ Frame 0B16	35 KB 13 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=280&adk=3088186576&adf=1809827648&pi=t.aa~a.2302603021~rp.4&w=1200&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1200x280&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280&nras=2&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=200&ady=1390&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=4&uci=a!4&btvi=1&fsb=1&xpc=O1vt8Xyjwe&p=https%3A//steprimo.com&dtd=10 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 11:58:52 GMT content-encoding br x-content-type-options nosniff age 22677 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13555 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 05 Jan 2023 11:58:52 GMT
GET H3	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 7AF4	2 KB 1 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/window_focus_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:15:42 GMT content-encoding gzip x-content-type-options nosniff age 67 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1332 x-xss-protection 0 server cafe etag 3351516697335751560 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:15:42 GMT
GET H3	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame 7AF4	119 KB 36 KB	25ms 24ms	Script text/javascript	2a00:1450:4001:82a::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 87f7f86b17eacf56e623a69be05e5f5487470d6b30347efe12742aefa3f5af48 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:49 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 37305 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="active-view-scs-read-write-acl" etag "1638461285297402" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/ Frame 7AF4	15 KB 6 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20211207/r20110914/client/qs_click_protection_fy2019.js Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ffb89f1f1fa54e822805cddf1f6ec0492cd8b806b36a921eda855241d1eee914 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:12:28 GMT content-encoding gzip x-content-type-options nosniff age 261 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6464 x-xss-protection 0 server cafe etag 15715955993838318253 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Wed, 19 Jan 2022 18:12:28 GMT
GET H3	200	index.html Show response tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/ Frame 9C58	153 KB 25 KB	9ms 7ms	Document text/html	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash b32688c6a904698b92220c7a34832402acdd326ff715643c9dc7022249f7c256 Security Headers Name Value Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ Response headers accept-ranges bytes vary Accept-Encoding content-type text/html access-control-allow-origin * content-security-policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} timing-allow-origin * date Wed, 05 Jan 2022 07:15:23 GMT expires Thu, 05 Jan 2023 07:15:23 GMT last-modified Fri, 18 Jun 2021 10:34:48 GMT x-content-type-options nosniff x-dns-prefetch-control off content-encoding gzip server sffe x-xss-protection 0 content-length 25702 age 39686 cache-control public, max-age=31536000 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	adview googleads.g.doubleclick.net/pagead/ Frame 7AF4	0 0	52ms 51ms	Fetch text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/adview?ai=CnqvckeDVYYvKBPL5gAP8j6qwBOXA4cBnnOCxxowP5LzZqdcqEAEg85HxImC7BqABgZCOzgPIAQmpAhU38jhYu7Y-qAMByAMCqgSUAk_QtVC7iL2OpgsIJevwqMz8szOqjbumoQCW5oXaLcZvMYtphDxhoI5-rLjnvCFXQr2pLEM7LYI2oitidTvvx6BPXnyShMoyY6GmKGYvT8LMIuqk_3zlPUecDEWOQgMtB4c4j1e5oBsyH6X3GG7L4GpkLNfk8N_eWY1tQLW1LSqcnohbtYcY9Zp5FWVN8fJUKDgYz_nzDmhLjQiTmEFTbmR6w8NK-Q78Chne_6pb4wlNgA0WHvPTV0ImqD6dSvfx0hiKw-yaG50JWitcWkFgiTlDGJy6zVJ-whZyyJumv5OWHKz8PcwqeednEC0BGeAhecbleZS5elKDANk0FMeKQjC76CNR3xTBTjcU9TgKISiWCez_MMAE_fP4zN4DkgUECAQYAZIFBAgFGASgBl2AB-fv8TGoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDHtBLSCAkIgOGAEBABGB-ACgHICwHYEw3QFQGAFwGyFxwKGggAEhRwdWItNDg1MTIzMjA2Nzg5ODgzMRgA&sigh=4j4eQnBm6wc&uach_m=[UACH] Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * content-security-policy script-src 'none'; object-src 'none' x-content-type-options nosniff server cafe date Wed, 05 Jan 2022 18:16:49 GMT p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0
GET H3	200	s Show response googleads.g.doubleclick.net/pagead/drt/ Frame 3EDD	143 B 163 B	8ms 6ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211 Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Response headers content-type text/html; charset=UTF-8 x-content-type-options nosniff content-encoding gzip date Wed, 05 Jan 2022 18:02:27 GMT server cafe content-length 145 x-xss-protection 0 cache-control public, max-age=3600 age 862 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
POST H3	204	gen_csp pagead2.googlesyndication.com/pagead/ Frame 7AF4	0 20 B	55ms 40ms	Other image/gif	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CMvW9o6cm_UCFfI8YAod_IcKRg&gqi=kODVYaSROfWBwuIPhoKymAk&layout=/sadbundle/%24csp%253Der3%24/215047436056395776/index.html Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://googleads.g.doubleclick.net/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/csp-report Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:49 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	css fonts.googleapis.com/ Frame 9C58	1 KB 407 B	15ms 15ms	Stylesheet text/css	2a00:1450:4001:808::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato:400,700&display=swap Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 7ad3ff657f32032ef8efa653730c135bd6aab764db571b1de66d295ec10c81ac Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Wed, 05 Jan 2022 16:19:03 GMT server ESF cross-origin-opener-policy same-origin-allow-popups date Wed, 05 Jan 2022 18:16:49 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Wed, 05 Jan 2022 18:16:49 GMT
GET H3	200	nadir-hero-img.jpg tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/ Frame 9C58	113 KB 113 KB	8ms 8ms	Image image/jpeg	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/nadir-hero-img.jpg Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 830966159f5de04c698b991860de7d3ad1056825d1f6f0552526da6d0900b4c3 Security Headers Name Value Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' x-content-type-options nosniff age 66761 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 115279 x-xss-protection 0 last-modified Fri, 18 Jun 2021 10:34:48 GMT server sffe date Tue, 04 Jan 2022 23:44:08 GMT report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Wed, 04 Jan 2023 23:44:08 GMT
GET H3	200	Enabler.js Show response tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 9C58	16 KB 6 KB	7ms 7ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/gadgets/html5/Enabler.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 5f0207bbbd69497c7a37284c0b6f9bdcc9f83c574a4cda737e00a390d0ed268f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 23:28:27 GMT content-encoding gzip x-content-type-options nosniff age 67702 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 5866 x-xss-protection 0 server cafe etag 544157900006238945 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control public, max-age=86400 timing-allow-origin * expires Wed, 05 Jan 2022 23:28:27 GMT
GET H3	200	addata.js Show response tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 9C58	26 KB 10 KB	7ms 6ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 16:13:39 GMT content-encoding gzip x-content-type-options nosniff age 7390 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 10382 x-xss-protection 0 server cafe etag 12806417668659483808 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control public, max-age=86400 timing-allow-origin * expires Thu, 06 Jan 2022 16:13:39 GMT
GET DATA	200 OK	truncated / Frame 7AF4	208 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 2ad1dda57efd1d2e2f5b5caf85fb16ba9ba402591a2f8bb0cd00bec9a28b3415 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/png
GET H3	200	si Show response googleads.g.doubleclick.net/pagead/drt/ Frame 3EDD Redirect Chain https://www.google.com/pagead/drt/ui https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA	0 16 B	80ms 79ms	Document text/html	2a00:1450:4001:80e::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211 Response headers p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" content-type text/html; charset=UTF-8 x-content-type-options nosniff date Wed, 05 Jan 2022 18:16:50 GMT server cafe content-length 0 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" expires Wed, 05 Jan 2022 18:16:50 GMT cache-control private Redirect headers location https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA cache-control private content-type text/html; charset=UTF-8 x-content-type-options nosniff date Wed, 05 Jan 2022 18:16:50 GMT server cafe content-length 0 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	S6uyw4BMUTPHjx4wXg.woff2 fonts.gstatic.com/s/lato/v20/ Frame 9C58	23 KB 23 KB	7ms 7ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v20/S6uyw4BMUTPHjx4wXg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash c3c0d3f472358aac78455515c4800771426770c22698e2486d39fdb5505634e1 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin null Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 29 Dec 2021 20:12:18 GMT x-content-type-options nosniff age 597871 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 23484 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:19:01 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Thu, 29 Dec 2022 20:12:18 GMT
GET H3	200	S6u9w4BMUTPHh6UVSwiPGQ.woff2 fonts.gstatic.com/s/lato/v20/ Frame 9C58	22 KB 22 KB	8ms 8ms	Font font/woff2	2a00:1450:4001:810::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/lato/v20/S6u9w4BMUTPHh6UVSwiPGQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css?family=Lato:400,700&display=swap Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8d3ca80fa271e94b0c36cf3053b0f806b7a42bb3395b424c99dc0bd218f0ac20 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin null Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Tue, 04 Jan 2022 20:12:20 GMT x-content-type-options nosniff age 79469 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 22992 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:18:57 GMT server sffe report-to {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]} content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="apps-themes" expires Wed, 04 Jan 2023 20:12:20 GMT
GET H3	200	nadir-hero-img.jpg tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/ Frame 9C58	113 KB 113 KB	7ms 7ms	Image image/jpeg	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/nadir-hero-img.jpg Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/index.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 830966159f5de04c698b991860de7d3ad1056825d1f6f0552526da6d0900b4c3 Security Headers Name Value Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' x-content-type-options nosniff age 66762 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 115279 x-xss-protection 0 last-modified Fri, 18 Jun 2021 10:34:48 GMT server sffe date Tue, 04 Jan 2022 23:44:08 GMT report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Wed, 04 Jan 2023 23:44:08 GMT
GET H3	200	HRZ_RY_TK_rgb.svg tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/ Frame 9C58	9 KB 4 KB	10ms 10ms	Image image/svg+xml	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/HRZ_RY_TK_rgb.svg Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bd05c4e7898527514e35ce29e5144acce25e1d96073573f57d841a79a8df42c7 Security Headers Name Value Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' content-encoding gzip x-content-type-options nosniff age 596259 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3663 x-xss-protection 0 last-modified Fri, 18 Jun 2021 10:34:48 GMT server sffe date Wed, 29 Dec 2021 20:39:11 GMT vary Accept-Encoding report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Thu, 29 Dec 2022 20:39:11 GMT
GET H3	200	VRT_RY_TK_rgb.svg tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/ Frame 9C58	9 KB 4 KB	10ms 9ms	Image image/svg+xml	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/VRT_RY_TK_rgb.svg Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 24a8bd06751890737b6d157deecd20daba65d21ffffb22c70a4a6b3df6084462 Security Headers Name Value Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' content-encoding gzip x-content-type-options nosniff age 80118 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3831 x-xss-protection 0 last-modified Fri, 18 Jun 2021 10:34:48 GMT server sffe date Tue, 04 Jan 2022 20:01:32 GMT vary Accept-Encoding report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Wed, 04 Jan 2023 20:01:32 GMT
GET DATA	200 OK	truncated / Frame 9C58	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers Content-Type image/gif
GET H3	200	HRZ_RY_TK_rgb.svg tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/ Frame 9C58	9 KB 4 KB	7ms 6ms	Image image/svg+xml	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/HRZ_RY_TK_rgb.svg Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash bd05c4e7898527514e35ce29e5144acce25e1d96073573f57d841a79a8df42c7 Security Headers Name Value Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' content-encoding gzip x-content-type-options nosniff age 596259 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3663 x-xss-protection 0 last-modified Fri, 18 Jun 2021 10:34:48 GMT server sffe date Wed, 29 Dec 2021 20:39:11 GMT vary Accept-Encoding report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Thu, 29 Dec 2022 20:39:11 GMT
GET H3	200	VRT_RY_TK_rgb.svg tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/ Frame 9C58	9 KB 4 KB	7ms 7ms	Image image/svg+xml	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/VRT_RY_TK_rgb.svg Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 24a8bd06751890737b6d157deecd20daba65d21ffffb22c70a4a6b3df6084462 Security Headers Name Value Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' content-encoding gzip x-content-type-options nosniff age 80118 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 3831 x-xss-protection 0 last-modified Fri, 18 Jun 2021 10:34:48 GMT server sffe date Tue, 04 Jan 2022 20:01:32 GMT vary Accept-Encoding report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/svg+xml access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Wed, 04 Jan 2023 20:01:32 GMT
GET H3	200	nadir-hero-img.jpg tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/ Frame 9C58	113 KB 113 KB	7ms 7ms	Image image/jpeg	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/215047436056395776/nadir-hero-img.jpg Requested by Host: googleads.g.doubleclick.net URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4851232067898831&output=html&h=90&adk=3943618427&adf=26568730&pi=t.aa~a.2302584692~rp.2&w=1190&fwrn=4&fwrnh=100&lmt=1641406608&rafmt=1&to=qs&pwprc=8219563212&psa=0&format=1190x90&url=https%3A%2F%2Fsteprimo.com%2Fandroid%2Fus%2Fapp%2Fcom.americanexpress.receiptmatch.activities%2FAmex-Business%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1641406608906&bpp=1&bdt=947&idt=-M&shv=r20211207&mjsv=m202112060101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D4d2ff54ac0e43567-222dcdb216cd009a%3AT%3D1641406608%3ART%3D1641406608%3AS%3DALNI_MaGM9I4Uy_YsUzH_zWoIJoNTKGM7Q&prev_fmts=0x0%2C1200x280%2C1200x280%2C1200x280&nras=3&correlator=6820309366325&frm=20&pv=1&ga_vid=1753832092.1641406608&ga_sid=1641406608&ga_hid=1470911136&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=205&ady=1695&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31063825&oid=2&pvsid=2456218741892398&pem=209&tmod=2&eae=0&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=5&uci=a!5&btvi=2&fsb=1&xpc=gk16RlZpEp&p=https%3A//steprimo.com&dtd=12 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 830966159f5de04c698b991860de7d3ad1056825d1f6f0552526da6d0900b4c3 Security Headers Name Value Content-Security-Policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers content-security-policy default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none' x-content-type-options nosniff age 66762 x-dns-prefetch-control off cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 115279 x-xss-protection 0 last-modified Fri, 18 Jun 2021 10:34:48 GMT server sffe date Tue, 04 Jan 2022 23:44:08 GMT report-to {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]} content-type image/jpeg access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="content-ads-owners" expires Wed, 04 Jan 2023 23:44:08 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame 9451	42 B 64 B	41ms 41ms	Fetch image/gif	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstausOEY5V-GXkHD5vf3hrxgAMesSkfutVhfiDvpcJbdk5ehmTRPg0ae79PW68Ti4SZwN5MQasvL3ES_i4Kmjui0kKNKBYrakY9psXBWg_I2CNuDquBRg&sai=AMfl-YR3-_8XpUsU58BokI0emR9y4Kt68VilyYSJVUQ3bZykiVhu0KxhrMfDHE9-UKXx9NR-I1URpDfGqelE&sig=Cg0ArKJSzMj0jdlFH3wCEAE&id=lidar2&mcvt=1000&p=0,0,280,1200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=1459884512&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641406608264&rpt=855&met=mue&wmsd=0 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:50 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	sodar Show response pagead2.googlesyndication.com/getconfig/	11 KB 8 KB	25ms 24ms	XHR application/json	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211207&st=env Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 49663d0cbcfc7bf99e60c2d98e37ca3a1d9f6eab658ee09a68c2493e504e7c7a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers timing-allow-origin * date Wed, 05 Jan 2022 18:16:50 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8569 x-xss-protection 0
GET H3	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 6 KB	20ms 20ms	Script text/javascript	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: pagead2.googlesyndication.com URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202112060101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-4851232067898831&plah=steprimo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 18:16:50 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6386 x-xss-protection 0 server sffe cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" etag "1637097310169751" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes expires Wed, 05 Jan 2022 18:16:50 GMT
GET H3	200	activeview Show response pagead2.googlesyndication.com/pcs/ Frame FE21	42 B 64 B	41ms 40ms	Fetch image/gif	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssrNFPFZdNyg229V_yv6SrE2QMaf5yzIwjdwU8DYvfV_3FjNLcCL3WSiGdeucSFAseF_KedTtk8Ndmdba3faZ3An_-AXIZV9YWcI0qQi1fnhVl8Ba7Tjw&sai=AMfl-YRJVdMizRJOQPnYJbLArsSRoFtxcSyAUQZAoK9X0T4vFEyV0fkta5UztYKRl4NohJ6t_dGaTYJdmwzT&sig=Cg0ArKJSzJauWoCmQdP9EAE&id=lidar2&mcvt=1000&p=0,0,280,1200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211202&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=22&adk=2473048226&rs=2&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1641406608284&rpt=934&met=mue&wmsd=0 Requested by Host: www.googletagservices.com URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://googleads.g.doubleclick.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:50 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/225/ Frame DD4B	13 KB 5 KB	7ms 6ms	Document text/html	2a00:1450:4001:80e::2001 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5046 date Wed, 05 Jan 2022 17:44:02 GMT expires Thu, 05 Jan 2023 17:44:02 GMT last-modified Mon, 21 Jun 2021 20:47:05 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 1968 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	aframe Show response www.google.com/recaptcha/api2/ Frame 8A0B	783 B 534 B	16ms 16ms	Document text/html	2a00:1450:4001:810::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 00f9a9cd908061c6d966aec74bd6bb702a789a99946f4b47d6bbd7e0e50bcfeb Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-sv/4bs3zn1ZyvpcUn1qoHA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy require-corp report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Wed, 05 Jan 2022 18:16:50 GMT date Wed, 05 Jan 2022 18:16:50 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-sv/4bs3zn1ZyvpcUn1qoHA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 512 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Show response pagead2.googlesyndication.com/bg/ Frame DD4B	35 KB 13 KB	8ms 8ms	Script text/javascript	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/EnZy1JEvhtfL3qsMHM2VNqoz8zWnsWCdOjk5wdd4Ig4.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 127672d4912f86d7cbdeab0c1ccd9536aa33f335a7b1609d3a3939c1d778220e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers date Wed, 05 Jan 2022 11:58:52 GMT content-encoding br x-content-type-options nosniff age 22678 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13555 x-xss-protection 0 last-modified Mon, 06 Dec 2021 19:18:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="botguard-scs" vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 05 Jan 2023 11:58:52 GMT
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame 8A0B	0 0	55ms 54ms	Image text/html	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20211207&jk=2456218741892398&rc= Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers
POST H2	200	result Show response steprimo.com/cdn-cgi/challenge-platform/h/g/cv/	2 B 563 B	362ms 60ms	XHR text/plain	2606:4700:e2::ac40:851e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://steprimo.com/cdn-cgi/challenge-platform/h/g/cv/result?req_id=6c8eb322aba24a79 Requested by Host: steprimo.com URL: https://steprimo.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:e2::ac40:851e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df Request headers Referer https://steprimo.com/android/us/app/com.americanexpress.receiptmatch.activities/Amex-Business/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Content-Type application/json Response headers date Wed, 05 Jan 2022 18:16:50 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y%2Bgzmk8%2Bxuf%2Bv6m5XLDC4WBg5iGI%2BrJ1GUfcEdiLJiu4P3hTK%2Brt7J6ng7jfm3bRMIrIhdtT7FSowdEsXyd%2FcH2YWSW5oSJ5XDaJi9BL76fZGdZ5LKjP9HuOGjagY1ZYsxg%2B%2FEkczIHTVJ8%3D"}],"group":"cf-nel","max_age":604800} content-type text/plain;charset=UTF-8 cf-ray 6c8eb33599924a79-FRA alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 2
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	42ms 41ms	Image image/gif	2a00:1450:4001:830::2002 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20211207&jk=2456218741892398&bg=!1Nel15PNAAZKWFskSlg7ACkAdvg8WrldVf3TUJ5pFBaA1r6bFOtcqId9nFj2OR39imasvGaXJgFKrgIAAAEBUgAAAAhoAQcKABn0BIoGEeFqZcKqUGatjqeqsf1JkxgKhz2NmQKXcWNyOr8E1vFH1QehUgad48yJcAagQvbBgM4QJNL6uR8aluPPMYcdB_buRMEFNQJOMVnYOiVy6dWm9uTbBy1tn1c8Y8mDNGA3LFHZjAmSUztcb5Hz75hnlsrWFtHURMfH4Vy3Fn51N-vXDD1AonGxju-rIDxgUUTTg-BqhjR34QGWrvWjO-9Kl6W3xVxA1dlzlCnzEaV1mU6HXL0aWL8dC5fhgkdqU_SGa2qiVsCb4RxowDF5l9R-64IzcusTka6mBkxOdRc82rXf__WktuXxeHndTL7HFUcJTtpSeegogSvOE6J2su6r4mpL1y2FPn4vDxrSW5ujML2Nt-wFNTEKyUn5Ca5e4LhEuRPzF66P_9wEaWqiGvo9JH23YOKJz33tFk7_N5dSHwB6NJnApc1eMAuil0RhBIUuhMXjC51qITvg_kv9jmJGGx2VN5tqbmlwzu9qzXVHiP50QyjzDj232wuSKRD4RPuGMQJuoqQcYh3XYdLLDokcMUhJK-2xw4dRfh-7juYng1EpxQJ3I8CsE2PLvQIVjEHmOZskOc5muo_YVVF7WDg1tiLYvmP2s5Q3v47BJiMqBw1WwK_fBKFc2mgIkosfulDjEbIggGaEq4-Z88rlS4QqiKBr0xWb2HPSWT3Lmi_tSJDGQQiWDpYGoxK_CAPtLUqqVWRnDBie_bxa7Hp08sEJx6INwAnNWBhjP6TONRYOxffEv2uu0BZtxX7Is8HYPzCefuk6X4XUJvapowSl0Og3MYfdkEab6FY2SJNeOUFJO4yeGIA0M1ScqHhPGPDkzVxkOVCX0C-18mI9tv3rkMosRRFW1R5r4ssGTRJbSLra9_PnjcitMnb9OBKB7lj1t8fsTdp7jpwR0PRxFoTx9yIR Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://steprimo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 Response headers pragma no-cache date Wed, 05 Jan 2022 18:16:50 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

cm.g.doubleclick.net

URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_gid=CAESEOX7QBis1ajM5QpbKemaEVk&google_cver=1&google_push=AYg5qPIbSrv-1U7LsAUnpIv2PtTW99m1dxDwjpyyw5UKb2LoK4C0RYQw6Sa7O0_bgx2HCmQteN-xUU2KvNt80jZ0LSgqCBW7-MU

Domain

cm.g.doubleclick.net

URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YdXgkX8EAPuI3XA1zxBp5gAABJ4AAAIB&google_cver=1&google_push=AYg5qPK_gVfw9uDBT3mL8Y8tQ3l7cJvwRz3u-BGFwA1f_ubDUpb11bX7e8WLZAV-FnnV3Kb7O_Sa3RdYOHOKvz3HuJp3jgm9Yew&google_gid=CAESEA1rhTbtMlRkFYQg7Pot0dA