plusonbr.com Open in urlscan Pro
2606:4700:3036::ac43:ac27 Public Scan

Software

sffe /

Resource Hash

8f2ff1503d4dd5eeb8a697400c0e04c53f6adaffbbe6c81bbb3afd943fc4770a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27312
x-xss-protection: 0
server: sffe
etag: "1119 / 774 of 1000 / last-modified: 1643803743"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 02 Feb 2022 13:10:02 GMT

GET
H3 200 logo.png
plusonbr.com/wp-content/uploads/2021/08/ 8 KB
9 KB 55ms
51ms Image
image/png 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/08/logo.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c94e1e3f15da3b3acb696439f1d416428913fd41b65df297dced70c43c665799

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 64269
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZydpoBc7T7e9UaXn11j3ysjsJpO%2FNMDLH1YzjenkT%2B54T9NTu%2F7TEP%2FGyY16QVhbYdKOp7Uwmyv4Zjrn1cMUY4n0Hq6Q59fIUZgu1IyR5W%2FY4LzIv9%2BaBax0NhFAfJf7lmmuJQ7TTHwbd9k%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 8190
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Aug 2021 13:42:43 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "6107f653-1ffe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a84809ee5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-da-Ibi-Digital-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/07/ 8 KB
8 KB 158ms
154ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-da-Ibi-Digital-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc69d4020975f9c7e65bf810719ddc721c67cbfd6ff47ff74dcd9c3d9df1684e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iP7wbRe7VOmDBLOKQu9kClbdq8IMSfOHn7bF8yZcGe1pAI825YLNTVK%2F0hR4nNjp3BlCRQg5gXh1CvhEJCEyzjPGQaceGndpoJ%2FD3Uor%2BYoXwcSyM7aHevTIFx6X1M6iYBgd9gPC0uv47BA%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 7782
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 16 Jul 2021 16:50:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f1b8e5-1e66"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a84809f35c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-Consignado-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/07/ 9 KB
10 KB 180ms
176ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-Consignado-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7808c6925aae490057d69df3ab847fdee3d9a79c1d73cae3204a2ed74adab077

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cHM6QJVGECI88hPwN2aCZC5venp2sYsKbfqIkYIjdXURgBvnb%2Bh3M2cjgTILj8lhZBVCSa4iKLbiTxOKtPIjjn7f4Zdro%2FBeXEyda03o9VHRLMjYWwonhAPPx%2FAAJ9pQHRcQPOtO4dXe9HY%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 9382
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 18 Jul 2021 21:22:37 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f49b9d-24a6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a84809f75c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-Mova-285x211.jpg
plusonbr.com/wp-content/uploads/2021/07/ 36 KB
37 KB 202ms
198ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-Mova-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

02dfab6503e355a1fe89fa5eae61abe43063d92f78b189a25fa88e02fc54b38e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=izvii8YiVlZIYXuEsXma%2BAT0Z%2FzaYWShhfehAJg7xnCzEXmKrTpKNJFeLHDqBe1qcQhwP0mJs9V6P%2FLv6PtD4zls6NM0dG9jbAqucQzd5r3gCJXpytYOP1BoGJdweTbKHBuZ8D6OBBtN0aU%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 37124
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 16 Jul 2021 18:55:07 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f1d60b-9104"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a84809f95c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-Ame-Digital-285x211.jpeg
plusonbr.com/wp-content/uploads/2021/07/ 4 KB
5 KB 231ms
228ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-Ame-Digital-285x211.jpeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

52c27905620498f7bd801d98b39ab82ffbea79ea4004b84f4987aa124d327c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kb86FwO2S1zV3oeCHWLMIwEig9aKtNstkMQbk1IqeGXsnAKvf9f%2BDVNNODkvAqj7yHblfpxmj5THY14D4St3kdCpyNWw4ecZu4jOqi2o%2BIhqrDggslE31kTfI5x0WbEerdVnzjv3z2V2yvI%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 4457
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 16 Jul 2021 19:38:39 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f1e03f-1169"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a195c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 emprestimo-pessoal-bradesco-como-solicitar-8473-285x211.jpg
plusonbr.com/wp-content/uploads/2022/01/ 9 KB
9 KB 199ms
195ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2022/01/emprestimo-pessoal-bradesco-como-solicitar-8473-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a7e17e4d93147a2d805a958fe686199803d6fdf204bb27099a39e57683e4a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n8NB2shx9hdCFGLYdUWZc0H%2FHxYu76gfXdKho2E%2FZriRzc5Zs79xYzHwWOBo8z1d%2FuOnS8i8DBYNYQQoFu2gRD4mgCp2GcF5xF4Fi0udnJkjTHkMqBUH16gP4VJgjLiMIXlKNkBuea85dMw%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 8858
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 22 Jan 2022 00:46:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61eb53ca-229a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a205c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 1 Show response
plusonbr.com/form_campanha/ 11 KB
3 KB 199ms
198ms Script
application/javascript 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/form_campanha/1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7dd86737d0d937c4cd5e1a3212ead1f1103f7202b721faec43abfc0972d56881

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gA6XQhtlmyl%2BRWisp%2BuTqC370g5EHI9JkK1dgKN49SLvl1qkvhyQwrw7f0VRZgpj1b2e1NWasPUAeF%2FbitwdEpwBNWE1Mc5LDXKGWZTGJI7fBvUuktMwtIZrGaHok7Wv3rAHPel2y%2FJiEi0%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: cloudflare
x-frame-options: SAMEORIGIN
cache-status: EXPIRED
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: application/javascript
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray: 6d73a847f9bc5c38-FRA
protected: by MS22012501

GET
H3 200 caixa-emprestimos-para-negativados-tudo-sobre-2214.jpg
plusonbr.com/wp-content/uploads/2022/01/ 58 KB
59 KB 211ms
208ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2022/01/caixa-emprestimos-para-negativados-tudo-sobre-2214.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3fe16ec35cf24714e7770c7d438ca0cb6495241bac5f8cb5e7520426cbe2d0e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m8WQveFQpxYR7f7rpikrwO6qf3qK8DCWH031lTxSAVPqCQatTMb0ZUw5lrKwJjo8PgdMvlqf58%2FjgKT2%2Fy0JSmVJevIc%2F2bjuipCFNvdDJ%2BTD56czFYInXwKvQBgBxGKlONHxcnT2qAGjko%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 59668
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 31 Jan 2022 14:10:03 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61f7edbb-e914"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a245c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-SIM-285x211.png
plusonbr.com/wp-content/uploads/2021/07/ 25 KB
25 KB 194ms
191ms Image
image/png 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-SIM-285x211.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c1e24afbfbb4c366bd9dbc0e12db5f0d0e635d1643c8aeccd22b3c8149554258

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SM%2Fw6vAA7InX1Ct8ZK0BQJwUHkPBYAtq9fsmwLeFsO9oqnc3mN2v7RiCFS30JOh0XP1fXas%2Faf3WRAVk8kXawQQENx30Z4ayofuTSSczwloDSXId5TaX0ciLogEfzwiLMc1uODPjM7nQgs4%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 25119
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 16 Jul 2021 19:32:00 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f1deb0-621f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a2d5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 emprestimo-pessoal-digio-passo-a-passo-para-solicitar-1308-285x211.jpg
plusonbr.com/wp-content/uploads/2022/01/ 20 KB
21 KB 233ms
229ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2022/01/emprestimo-pessoal-digio-passo-a-passo-para-solicitar-1308-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

070f4959eaac2d51c324fef728719f7b6b8c9014f1a11bb4ac37902a756ef129

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fjv3pDMjcw8C9UnBorIQmAe4KykSm9VHpSJMzF3Q3OAtrOBw4kOj2gp5rx9CJamiEkPGowmjdMTG512H6amKPgCWp5A1XoB80wY%2BLBmteQQFnEDacUgPQhrxAxVYSYWwkR8ZSpCtfkAEsN4%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 20655
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 29 Jan 2022 17:39:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61f57bb6-50af"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a2f5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-Pessoal-Credisfera-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/07/ 5 KB
6 KB 192ms
188ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-Pessoal-Credisfera-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2fe5ccc727622c2cbbc1e8f2d522a2779ffdffa1b7b14db7fc3c3ae83812f605

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Idft%2BoMqtgTCgFQlkrO7nvrk1Gv4nTfz8CY89MOF3z0NBnJLiRHdZwN3sROa9%2FrxPdPJt6gfviEA%2Bw5vomDYJSHO9H%2F9gwpKfsEWBmZmzuvWNI9GElGYWfFPVr0h8KAYjJc7kBPICy%2FM4Gk%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 5124
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 17 Jul 2021 12:40:32 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f2cfc0-1404"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a395c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-para-Negativados-do-Banco-Inter-285x211.png
plusonbr.com/wp-content/uploads/2021/07/ 74 KB
74 KB 252ms
248ms Image
image/png 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-para-Negativados-do-Banco-Inter-285x211.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c74ddb4531316122320fa43080d5ef8e47a99d4a04dae47370b912fa9553ecfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MEwbzZioVgr%2Boop7CK47EKUTJ%2BDDZxvZRBYjiZSnyH%2Fmt3I2fFksjZxq7Fth1LEfIuICAO6yaIDEhXL%2FCm9ZYKPF0dGSwlZgw7LzhAaW4fE8VUe1BAmJzezrqynq%2B61%2FKNddHL5FobWPo9A%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 75280
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 16 Jul 2021 19:57:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f1e499-12610"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a3c5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-Pessoal-Losango-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/07/ 6 KB
6 KB 246ms
243ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-Pessoal-Losango-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b36953d7efd89313cce718921cf15302988da31b93c51f8959bbfd0aca96df8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JybSpzT94JC2pVksJ7G%2B0ejDUxz0LbJba0h9WgPdBOCyGDS6cgNKU7OtqZV6Epb%2BXb8Tdedi8dZ93JGBX3xszlNukcKx%2FoyhtIVBCyj479alTVs7tf62ZVfR10vycEAQVvKPcdV41TxreIg%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 5764
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Sat, 17 Jul 2021 02:25:31 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f23f9b-1684"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a3f5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Emprestimo-Online-PagBank-3-285x211.png
plusonbr.com/wp-content/uploads/2021/07/ 19 KB
20 KB 103ms
100ms Image
image/png 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/07/Emprestimo-Online-PagBank-3-285x211.png

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf5d9d982bd4cb229a9bd1bdfbcfa711b3be8124368df28acf50fea456b6efa5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SaA1UCf6aEFMDz7llpczNfuSmugwo1ctnHjrgnyL%2B6HDNhN11pvoyhNkYYlZJW2ZC8z5qhjhpfW56gh07v%2BiyHwQNHW0bXfxacpBVeld7S69Wg41RkZVpAhCZAIOGQudo7uJ6uYkfYlxmB4%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 19375
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Fri, 16 Jul 2021 16:44:10 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60f1b75a-4baf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a425c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Cartao-de-Credito-Caixa-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 4 KB
5 KB 247ms
243ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Cartao-de-Credito-Caixa-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff45a3f51834abbba03bed936ebd564ef89b37b1ddc30b0df0ada9b78d70ff5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FUgRQLbtRYxzxBhOxsUtoDsn2TFvQ0YbHLYg3DT%2BzW9eFtI85JD1esG3LrnBXGLgKY4jnD%2B87C4TP90hsObCPSF9%2FNrZWLQo4YgO6wLpYT0Yw2cVK3MHuNURGL6DXXAaA88daJq1onl9dmk%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 4398
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 07 Dec 2021 11:47:34 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61af49d6-112e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a495c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Cartao-Nubank-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/08/ 4 KB
5 KB 193ms
189ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/08/Cartao-Nubank-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c38c04e1ec36e7b0c339022826d5f47d77979c4bbf0d96f5580fdd832701279

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LIMI66wcOty4CCST0BqMXrS22JMa9kA5mkCKQToICbadVtSCokdJZLtGp6Vw1Xhd8ymIhURQxYtl%2F9IIk3pc3WyM4mmeLkCcqH2pyM%2BediERJT8PENNHhpMFpqVB8%2BKYe1cbrPZwvRqKR9U%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 4140
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 03 Aug 2021 15:23:38 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61095f7a-102c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a4a5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Cartao-Nubank-Ultravioleta-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 6 KB
7 KB 246ms
243ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Cartao-Nubank-Ultravioleta-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

66b416b3ffc9f62dc181317cbb710788312add1a355060fce77c3e227752c859

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=25ZbXiZxz%2B9gZCfow14UAEyrTm0G1l0HoUDSuikJWqirUeAsuk2aen2E4HxYNIs7WY6OqMWUiKj50IZbvJ015AbgnXY8oi9Dkzq7THAd%2BhmmjzWY6jY6e0S9R5PQnhtX4PrW%2BM%2FQQ4jMKu0%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 5992
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 08 Dec 2021 12:02:21 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61b09ecd-1768"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a515c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Consultar-Score-de-Credito-pelo-Celular-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 9 KB
10 KB 246ms
244ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Consultar-Score-de-Credito-pelo-Celular-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97ee6d7726e1d0484db79892c9058495ca7da53fee28b51cc2ac6f40cd21a89b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wr5fhS1s%2BuumELopKuvyawf%2FEnQjuF9YtaGW4vQTwLutpk9uZG63BSBWEY7ySEJZPiz31yzbc5KuqoYgNSvNTI4AgT%2BWoKa%2BWqnW1HzLPak2ulIUcOgXuzHhrZZX8NpIuufSyVhCdwl03Yk%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 9444
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 06 Dec 2021 16:29:42 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61ae3a76-24e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a535c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 Cartao-de-Credito-Banco-Pan-1-285x211.jpg
plusonbr.com/wp-content/uploads/2021/12/ 12 KB
13 KB 247ms
244ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2021/12/Cartao-de-Credito-Banco-Pan-1-285x211.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

331d80b82728f8fd00ff3fa7811e865fdd70c44fd6b2fbabdc2ee42394b9e8d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1Kp7MInwgviwyL2x1HqKDmrnK25PiEWsruSqa5aMGJdTCJf2rJN1xi1eS8P%2Bti8yY%2FCqyZGIEf7zQoGuYulDxCvJcb18jCFv7dMyeFocZkVtXG2hvItNB%2Fi7dHunXIsfHqhB7m2jlI2nf0o%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 12295
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Wed, 15 Dec 2021 14:41:42 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61b9fea6-3007"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a585c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
35 KB 141ms
63ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-207947697-1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

03946f99bfda39603544280dc6b67cc9c33057cae405444c4d3a7a1b61e420cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36217
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 02 Feb 2022 13:10:02 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 111ms
33ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-216818493-1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7b2f1a79f213daf44e6eb7970e8f885ba4ba165e7ed38d22bcccf46b29c37060

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36217
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 02 Feb 2022 13:10:02 GMT

GET
H3 200 flickity.js Show response
plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/js/ 54 KB
15 KB 163ms
162ms Script
application/javascript 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/js/flickity.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8c126bc13a8986f1a9ac0cfd1cd67280a5ae0eca52d4519fe702b7cf85c76a43

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dhjvCjC94MwQ4jUZnbVA%2Fo%2F%2F1SP5ATHJv7dKtOfTFXSRxMEdB0cHTRnWIR0aUjgQkhGaSD5e2jp9j1WlHlkGr%2FtP4Sw8kesVOtVrhzZngym%2Fn1BFU2sDTj%2FdLZVQXcJWPWGBcNUs2ytRR3c%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Aug 2021 13:12:39 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"6107ef47-d7cb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=315360000
cf-ray: 6d73a84809e55c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 funcoes.js Show response
plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/js/ 926 B
1 KB 126ms
122ms Script
application/javascript 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/js/funcoes.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d393fee4858d73610ef9ac7d9b9788f75147371523b18dc66ed92e62e1cf4e5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RySZJl4iSCtb1sNNpU6k5Bfs%2BJFwOA%2FTH4j8idiYyvbdCS%2FY7rN3UpAbgy5F1VMJFU8vP%2FtCmXvF2RVIOnyzHPXRxYb%2F3OcdLVsZVe2uPg%2F9HVx6ezpHT8PgEjrKlRuQgUrmpZRIGmpAufQ%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Aug 2021 13:12:39 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"6107ef47-39e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: application/javascript
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
cf-ray: 6d73a84809e85c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 wp-emoji-release.min.js Show response
plusonbr.com/wp-includes/js/ 18 KB
5 KB 252ms
250ms Script
application/javascript 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://plusonbr.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p%2B3%2BlNkX7ToqtRQJJYv74%2BWhVFowImLlcLeUxz0QO%2BCuXletK%2BitoEJPhbZOXtEeFaLz6gP0KnSNaSpiKb3rm%2FpJ1oSbjOpK49pTnMKZ1jgAwFptAaVkYiGy03tmc78ptw19ZBvbwFpC7z8%3D"}],"group":"cf-nel","max_age":604800}
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 20 Jul 2021 17:38:23 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"60f70a0f-4705"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=315360000
cf-ray: 6d73a8480a5c5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET bootstrap.min.css
plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/css/ 0
0

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201200501/ 284 KB
102 KB 94ms
64ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201200501/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2241041385197693&plah=plusonbr.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4673094797037072

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d56d11a78662a4a0c970c8aa9d0d68e9d2ddca2b87b49689f41d6769e4f1681

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104643
x-xss-protection: 0
server: cafe
etag: 5704457881863332529
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 02 Feb 2022 13:10:02 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220131/r20190131/ Frame DAC5 10 KB
5 KB 86ms
36ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220131/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-4673094797037072

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Tue, 01 Feb 2022 19:01:41 GMT
expires: Tue, 15 Feb 2022 19:01:41 GMT
cache-control: public, max-age=1209600
age: 65301
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 search.png
plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/img/ 550 B
1 KB 250ms
249ms Image
image/png 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/img/search.png

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/style.css?v=1643807401

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1bff94fc53b0367730ae0231d3ac6897ca493f98652f95613d5a2ee94d71eadb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/style.css?v=1643807401
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bq5dkYOsls%2BfIXZY4hIoJGmqr3yMf%2FJGuehu7CnuaHlix14wihIZEe8hs%2FMHUwEFhvPYEtFKUVDq46KviPJJ7uUHr%2BWk4Zm834eGAFyvt0TD19r74HHfKBhelfffgcHu3mYSe%2Fw7sU8eDMs%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 550
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Aug 2021 13:12:39 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "6107ef47-226"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a5f5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 topoSeparaMenu.png
plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/img/ 184 B
857 B 184ms
184ms Image
image/png 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/img/topoSeparaMenu.png

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/style.css?v=1643807401

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b9a760bb7f2b48d3f293dcb65b77aa6404ca9c381bb581c0fe393282316fc336

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/style.css?v=1643807401
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SxHSUKXzNqeWX%2BtpuzVitIz3Lcnm9%2FvTM%2BWmM1yGKIxisc99VxbG2K0SbthvG6H4fTbaFabflU0z8QWgg7WfZ09tlvDMgrJ0tMfoual9zzPAL4y2OPllIxiGYcIcr6xLF22c7dwZlt5sHAU%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 184
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 02 Aug 2021 13:12:39 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "6107ef47-b8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a8480a645c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 216 B
418 B 29ms
26ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=plusonbr.com&callback=_gfp_s_&client=ca-pub-2241041385197693

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202201200501/show_ads_impl_with_ama_fy2019.js?client=ca-pub-2241041385197693&plah=plusonbr.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5821b9f69a2193eed77dee4840e288cdfa8c174c6ecdad2ad04fcc2c141e332

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 203
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
792 B 106ms
26ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=plusonbr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 106ms
27ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=plusonbr.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8CFE 0
19 B 141ms
111ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2241041385197693&output=html&adk=1812271804&adf=3025194257&lmt=1643807402&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DJua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%253D&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1643807402201&bpp=37&bdt=166&idt=192&shv=r20220131&mjsv=m202201200501&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8743030310039&frm=20&pv=2&ga_vid=724411737.1643807402&ga_sid=1643807402&ga_hid=1127540542&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44753659&oid=2&pvsid=321971054602661&pem=357&tmod=713622960&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=214

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 02 Feb 2022 13:10:02 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 02 Feb 2022 13:10:02 GMT
cache-control: private

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 850 B
968 B 85ms
28ms Script
text/javascript 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/form_campanha/1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

61689f3f8cb81a680436abea2be12be3d73e9ecd33e6b281dfb9a4600e11aead

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 555
x-xss-protection: 1; mode=block
expires: Wed, 02 Feb 2022 13:10:02 GMT

GET
H3 200 pubads_impl_2022012701.js Show response
securepubads.g.doubleclick.net/gpt/ 355 KB
120 KB 52ms
18ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97f59ccead873800701418302300e1c43fc7d41efe5aeb412d8279fefd5cd913

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 12:53:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 974
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122333
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 09:34:36 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 02 Feb 2023 12:53:48 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 118 B
117 B 62ms
26ms XHR
application/json 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=plusonbr.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50987bc2ecdb8bc46e4600c1f227f514d558969da61cd968c6ce869d7b3434a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92
x-xss-protection: 0
expires: Wed, 02 Feb 2022 13:10:02 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ 355 KB
141 KB 78ms
18ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaf591220d6075ab9638f2ddebc32f5fc1d996c359f8c3a9b1f056a7e46dd6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
Origin: https://plusonbr.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143285
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 13:04:07 GMT

GET
H2 200 diffuser.js Show response
diffuser-cdn.app-us1.com/diffuser/ 24 KB
6 KB 88ms
31ms Script
application/javascript 2606:4700::6811:925b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Requested by: Host: plusonbr.com
URL: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:925b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15eb202865d1d835fae2eff61bb922fa91fb4064a1fb850ebadab1f190782648

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 62
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Thu, 21 Oct 2021 17:42:06 GMT
server: cloudflare
etag: W/"4d482a43613d3966f353ec9d97452e0c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 dde0b4b1e223fa23670e93078a04c116.cloudfront.net (CloudFront)
cache-control: public, max-age=300
x-amz-cf-pop: FRA2-C1
cf-ray: 6d73a84a280268f7-FRA
x-amz-cf-id: 06Md-IKTiQmqlYnrakoRyzILa1BcM4MfCimr4L-oRvVhelV01Nj8tw==

GET
H2 200 next.png
portalonbr.com/wp-content/uploads/ 1 KB
2 KB 162ms
70ms Image
image/png 2606:4700:3036::ac43:c7f8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://portalonbr.com/wp-content/uploads/next.png

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/style.css?v=1643807401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:c7f8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0f453bafbbba6a39685a4ac97a1dc89773da2adadf8940763ff4ad70a4aba5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/style.css?v=1643807401
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VbnizHyW8gYRTyZUaDsp2%2BG8e88sOHfn2Pl8YiLfjdw54tGxZRptVkQrrKCmKBrdFuRzPr8061%2BN6FdVaLPS33wK%2Frb9oQM9Oc753qL0QBQhgtQcINmcoHbwtqXEInaLD%2BG28CNpEhco1lMJsQ%3D%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 1328
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 18 Mar 2021 02:53:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "6052c099-530"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a84a6b329214-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 right.png
portalonbr.com/wp-content/uploads/ 1 KB
2 KB 168ms
76ms Image
image/png 2606:4700:3036::ac43:c7f8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://portalonbr.com/wp-content/uploads/right.png

Requested by

Host: plusonbr.com
URL: https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/style.css?v=1643807401

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:c7f8 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a981d1cf29a578baf94ef901db9a17e0f078f407d4133a806c465682ede97fc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/wp-content/themes/tema-emivaldo-EITANOVOTOP/style.css?v=1643807401
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qTvIlwpd4Us2qCVZbyfTle6I99fNfMHfsmx%2BnAtx8VK9XYpoJOOZ4%2FtdNkOO%2FW6HxZ%2BDivakDeCyuaUK3te4K9RJR2MRK8tZS4Qu9WSVKwPKOpxn4JyXx%2F%2BQ5IbxX0qGWOySUjHDLiaA85W6dg%3D%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 1301
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Thu, 18 Mar 2021 02:53:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "6052c099-515"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/png
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a84a6b359214-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H3 200 caixa-emprestimos-para-negativados-tudo-sobre-1342.jpg
plusonbr.com/wp-content/uploads/2022/01/ 24 KB
25 KB 127ms
126ms Image
image/jpeg 2606:4700:3036::ac43:ac27
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://plusonbr.com/wp-content/uploads/2022/01/caixa-emprestimos-para-negativados-tudo-sobre-1342.jpg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::ac43:ac27 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9a20e6eddc345b4fd8b192aeab9de53fb04a13be7c4b73e483fddd35782f41d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p7YR7z0%2FxF6bZr2%2Bgsnxlunz2mwfick1XnI3empoZnKl58Tdz0z137T4FIpXEZPq11Glfdn2iaeG2EIjXQrToBUq5%2FwzoCQ6OcrTQ1tuczvRNb%2FICKM9pXtWFxMFwluazxIdlzdYfTYMotE%3D"}],"group":"cf-nel","max_age":604800}
vary: Accept-Encoding
content-length: 24804
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
last-modified: Mon, 31 Jan 2022 14:10:03 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61f7edbb-60e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15768000;
x-download-options: noopen
content-type: image/jpeg
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6d73a84a2fff5c38-FRA
protected: by MS22012501
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 70ms
18ms Script
text/javascript 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-207947697-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 3910
date: Wed, 02 Feb 2022 12:04:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 02 Feb 2022 14:04:52 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
35 KB 61ms
34ms Script
application/javascript 2a00:1450:4001:800::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-216818493-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-207947697-1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1123e89d2a36dcb9a80c7394b9fe68a6efbdf11d3659bb388c3296d66746fd5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36217
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 02 Feb 2022 13:10:02 GMT

GET
H3 200 integrator.js Show response
adservice.google.se/adsid/ 107 B
122 B 53ms
27ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.se/adsid/integrator.js?domain=plusonbr.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 56ms
29ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=plusonbr.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Feb 2022 13:10:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame 0DC2 42 KB
22 KB 75ms
47ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML&co=aHR0cHM6Ly9wbHVzb25ici5jb206NDQz&hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&size=normal&cb=bwitsdig8k5q

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6a046cd76933835a389a9925780fc5263fc38a18f958323a46feb244393f1a76

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GQv47NIaPBXd0A/0COJd6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 02 Feb 2022 13:10:02 GMT
content-security-policy: script-src 'report-sample' 'nonce-GQv47NIaPBXd0A/0COJd6w' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 22008
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame FCF6 41 KB
21 KB 76ms
54ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML&co=aHR0cHM6Ly9wbHVzb25ici5jb206NDQz&hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&size=normal&cb=gbudfvcj9ck1

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

b38fee02f859ad78879e5bd820fb3d642aef577d160f8c3c14977b637a7c0441

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-YMIb65NZId4c2jI9G630WQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 02 Feb 2022 13:10:02 GMT
content-security-policy: script-src 'report-sample' 'nonce-YMIb65NZId4c2jI9G630WQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 21862
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 57 KB
13 KB 503ms
503ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=321971054602661&correlator=3861281152514415&output=ldjh&impl=fif&eid=31061815%2C31063378%2C44742768&vrg=2022012701&ptt=17&sc=1&sfv=1-0-38&ecs=20220202&iu_parts=22106840220%2Cplusonbr.com%2Cplusonbr.com_mw_content4_09082021&enc_prev_ius=0%2F1%2F2&prev_iu_szs=300x250&prev_scp=id_post_wp%3D1916%26utm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_campaign%3DEmpr%25C3%25A9stimo%252084%2520-%2520Atividades%2520Recentes%2520-%2520Pedro&cookie=ID%3Da04f976c41262516-228bb23d32cd0019%3AT%3D1643807402%3ART%3D1643807402%3AS%3DALNI_MZxR8dwOWRGnN45GaHgsEzcGOCk_Q&bc=31&abxe=1&dt=1643807402763&lmt=1643807402&dlt=1643807402036&idt=625&frm=20&biw=1600&bih=1200&oid=2&adxs=208&adys=2938&adks=3769313136&ucis=1&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DJua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%253D&vis=1&scr_x=0&scr_y=0&psz=876x24&msz=876x0&ga_vid=724411737.1643807402&ga_sid=1643807402&ga_hid=1127540542&ga_fc=false&fws=0&ohw=0&btvi=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c5b16c9fefdd43cb3f32f82854cc14985f81c4d80c21f0fb683561dccbb84a3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12988
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://plusonbr.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A3C0 6 KB
4 KB 102ms
31ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Wed, 02 Feb 2022 13:10:02 GMT
expires: Thu, 02 Feb 2023 13:10:02 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 66 KB
32 KB 877ms
877ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=321971054602661&correlator=3861281152514415&output=ldjh&impl=fif&eid=31061815%2C31063378%2C44742768&vrg=2022012701&ptt=17&sc=1&sfv=1-0-38&ecs=20220202&iu_parts=22106840220%2Cplusonbr.com%2Cplusonbr.com_mw_content3_09082021&enc_prev_ius=0%2F1%2F2&prev_iu_szs=300x250&prev_scp=id_post_wp%3D1916%26utm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_campaign%3DEmpr%25C3%25A9stimo%252084%2520-%2520Atividades%2520Recentes%2520-%2520Pedro&cookie=ID%3Da04f976c41262516-228bb23d32cd0019%3AT%3D1643807402%3ART%3D1643807402%3AS%3DALNI_MZxR8dwOWRGnN45GaHgsEzcGOCk_Q&bc=31&abxe=1&dt=1643807402770&lmt=1643807402&dlt=1643807402036&idt=625&frm=20&biw=1600&bih=1200&oid=2&adxs=208&adys=1607&adks=3333163208&ucis=2&ifi=3&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DJua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%253D&vis=1&scr_x=0&scr_y=0&psz=876x24&msz=876x0&ga_vid=724411737.1643807402&ga_sid=1643807402&ga_hid=1127540542&ga_fc=false&fws=0&ohw=0&btvi=2&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecea4e3293cd50ba41abdba596ec87ce2a1a03b29408cadef8b0bc8b575d01e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32974
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://plusonbr.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 1549ms
1548ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=321971054602661&correlator=3861281152514415&output=ldjh&impl=fif&eid=31061815%2C31063378%2C44742768&vrg=2022012701&ptt=17&sc=1&sfv=1-0-38&ecs=20220202&iu_parts=22106840220%2Cplusonbr.com%2Cplusonbr.com_mw_content2_09082021&enc_prev_ius=0%2F1%2F2&prev_iu_szs=300x250&prev_scp=id_post_wp%3D1916%26utm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_campaign%3DEmpr%25C3%25A9stimo%252084%2520-%2520Atividades%2520Recentes%2520-%2520Pedro&cookie=ID%3Da04f976c41262516-228bb23d32cd0019%3AT%3D1643807402%3ART%3D1643807402%3AS%3DALNI_MZxR8dwOWRGnN45GaHgsEzcGOCk_Q&bc=31&abxe=1&dt=1643807402772&lmt=1643807402&dlt=1643807402036&idt=625&frm=20&biw=1600&bih=1200&oid=2&adxs=208&adys=832&adks=3148325641&ucis=3&ifi=4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DJua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%253D&vis=1&scr_x=0&scr_y=0&psz=876x24&msz=876x0&ga_vid=724411737.1643807402&ga_sid=1643807402&ga_hid=1127540542&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4eb40875d62851d426932bf190229da8bdba82009a37296dd1872af03ec4bd77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9516
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://plusonbr.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 59 KB
13 KB 2517ms
2517ms XHR
text/plain 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=321971054602661&correlator=3861281152514415&output=ldjh&impl=fif&eid=31061815%2C31063378%2C44742768&vrg=2022012701&ptt=17&sc=1&sfv=1-0-38&ecs=20220202&iu_parts=22106840220%2Cplusonbr.com%2Cplusonbr.com_mw_content1_09082021&enc_prev_ius=0%2F1%2F2&prev_iu_szs=300x250&prev_scp=id_post_wp%3D1916%26utm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_campaign%3DEmpr%25C3%25A9stimo%252084%2520-%2520Atividades%2520Recentes%2520-%2520Pedro&cookie=ID%3Da04f976c41262516-228bb23d32cd0019%3AT%3D1643807402%3ART%3D1643807402%3AS%3DALNI_MZxR8dwOWRGnN45GaHgsEzcGOCk_Q&bc=31&abxe=1&dt=1643807402776&lmt=1643807402&dlt=1643807402036&idt=625&frm=20&biw=1600&bih=1200&oid=2&adxs=208&adys=688&adks=3450057507&ucis=4&ifi=5&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&dmc=8&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro%26vgo_ee%3DJua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%253D&vis=1&scr_x=0&scr_y=0&psz=876x24&msz=876x0&ga_vid=724411737.1643807402&ga_sid=1643807402&ga_hid=1127540542&ga_fc=false&fws=0&ohw=0&btvi=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

772c4c93f84385d0176e9b98b0a8a5b41d9dcffdf722f0102354617d79d701c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro&vgo_ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:05 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12888
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://plusonbr.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
prism.app-us1.com/ 329 B
362 B 859ms
857ms Script
application/javascript 2606:4700::6811:925b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prism.app-us1.com/?a=800701871&ee=Jua5MFp8ef99ipVMomicJ4ZFYzEa6q1pamXSjYVTdiM%3D&u=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro
Requested by: Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:925b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.27
Resource Hash: 1ccf9d51679722486c5a7fd9b0c1ec24f1c836620d2de7236bf320a5c9d18f21

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/7.4.27
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
cache-control: no-cache, private
x-envoy-upstream-service-time: 431
cf-ray: 6d73a84b8ad368f7-FRA

GET
H2 200 / Show response
prism.app-us1.com/ 250 B
417 B 517ms
516ms Script
application/javascript 2606:4700::6811:925b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prism.app-us1.com/?a=1001840538&u=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro
Requested by: Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:925b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.27
Resource Hash: 1640689d906f93846acafa7c709f1ce641b198c1eec593e30e062fc6ef12bd59

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/7.4.27
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
cache-control: no-cache, private
x-envoy-upstream-service-time: 83
cf-ray: 6d73a84b8ad268f7-FRA

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 54ms
28ms XHR
text/plain 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1127540542&t=pageview&_s=1&dl=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro&ul=en-us&de=UTF-8&dt=Caixa%20Empr%C3%A9stimos%20Para%20Negativados%20-%20Tudo%20Sobre&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=787356657&gjid=1885177514&cid=724411737.1643807402&tid=UA-207947697-1&_gid=264007990.1643807403&_r=1&gtm=2ou1v0&z=1314000071

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://plusonbr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 46ms
27ms XHR
text/plain 2a00:1450:4001:803::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1127540542&t=pageview&_s=1&dl=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro&ul=en-us&de=UTF-8&dt=Caixa%20Empr%C3%A9stimos%20Para%20Negativados%20-%20Tudo%20Sobre&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAjAAUABAAAAAC~&jid=669782638&gjid=1804898715&cid=724411737.1643807402&tid=UA-216818493-1&_gid=264007990.1643807403&_r=1&gtm=2ou1v0&z=791017387

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:02 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://plusonbr.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ Frame 0DC2 51 KB
24 KB 51ms
20ms Stylesheet
text/css 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML&co=aHR0cHM6Ly9wbHVzb25ici5jb206NDQz&hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&size=normal&cb=bwitsdig8k5q

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 12:58:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 697
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24237
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 12:58:25 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ Frame 0DC2 355 KB
140 KB 69ms
39ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaf591220d6075ab9638f2ddebc32f5fc1d996c359f8c3a9b1f056a7e46dd6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143285
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 13:04:07 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ Frame FCF6 51 KB
24 KB 47ms
18ms Stylesheet
text/css 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/styles__ltr.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 12:58:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 697
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24237
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 12:58:25 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ Frame FCF6 355 KB
140 KB 74ms
44ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaf591220d6075ab9638f2ddebc32f5fc1d996c359f8c3a9b1f056a7e46dd6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143285
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 13:04:07 GMT

GET
DATA 200
OK truncated
/ Frame 0DC2 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 0DC2 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 0DC2 2 KB
2 KB 18ms
17ms Image
image/png 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 01 Feb 2022 18:59:48 GMT
x-content-type-options: nosniff
age: 65414
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Tue, 08 Feb 2022 18:59:48 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 0DC2 15 KB
16 KB 66ms
20ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 01 Feb 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 93118
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 01 Feb 2023 11:18:05 GMT

GET
DATA 200
OK truncated
/ Frame FCF6 14 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0964d141519db34adc6aa127a33dbc6761cda1e56b584ea402082d99c44afb9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame FCF6 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 43ef4025567f7a15859b5252b6ccc1efe2ff8c7331b1aefbea7ce88eb5084d27

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame FCF6 2 KB
2 KB 22ms
21ms Image
image/png 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 01 Feb 2022 18:59:48 GMT
x-content-type-options: nosniff
age: 65415
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Tue, 08 Feb 2022 18:59:48 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame FCF6 15 KB
15 KB 20ms
20ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 01 Feb 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 93118
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 01 Feb 2023 11:18:05 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame 0DC2 102 B
134 B 27ms
27ms Other
text/javascript 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

739db8d736cf2cf264796656a113e1e2c97fb6d2626cf5a74bde38c219a04de7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML&co=aHR0cHM6Ly9wbHVzb25ici5jb206NDQz&hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&size=normal&cb=bwitsdig8k5q
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Wed, 02 Feb 2022 13:10:03 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame FCF6 102 B
134 B 29ms
29ms Other
text/javascript 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

739db8d736cf2cf264796656a113e1e2c97fb6d2626cf5a74bde38c219a04de7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML&co=aHR0cHM6Ly9wbHVzb25ici5jb206NDQz&hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&size=normal&cb=gbudfvcj9ck1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
content-security-policy: frame-ancestors 'self'
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 112
x-xss-protection: 1; mode=block
expires: Wed, 02 Feb 2022 13:10:03 GMT

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame 70C7 7 KB
1 KB 32ms
32ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

51d8ceecf2525d1ecaa9a088b29fb20e95e8b3fb30cc93959b62ff96abcc407e

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-0kE3o7PlBSMqo4j2hyOT9Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 02 Feb 2022 13:10:03 GMT
content-security-policy: script-src 'report-sample' 'nonce-0kE3o7PlBSMqo4j2hyOT9Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1110
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 bframe Show response
www.google.com/recaptcha/api2/ Frame E116 7 KB
1 KB 34ms
34ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f6ceef0cc20426f2a43a30a27ce8492d29dc292d09929ab95727346de8be9740

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-5cLuHQCQNQzNd8GXSIxj8A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Wed, 02 Feb 2022 13:10:03 GMT
content-security-policy: script-src 'report-sample' 'nonce-5cLuHQCQNQzNd8GXSIxj8A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 1113
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ Frame 70C7 51 KB
24 KB 37ms
37ms Stylesheet
text/css 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 12:58:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 698
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24237
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 12:58:25 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ Frame 70C7 355 KB
140 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaf591220d6075ab9638f2ddebc32f5fc1d996c359f8c3a9b1f056a7e46dd6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 356
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143285
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 13:04:07 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ Frame E116 51 KB
24 KB 39ms
38ms Stylesheet
text/css 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6d032132eed5aa1a417456f07864c51fe631858b190224cf7d1a50116d15f48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 12:58:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 698
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24237
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 12:58:25 GMT

GET
H3 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/ Frame E116 355 KB
140 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/dPctOHA2ifhWm5WzFM_B5TjT/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/bframe?hl=de&v=dPctOHA2ifhWm5WzFM_B5TjT&k=6Ld1heUcAAAAAFbAnVuU2JCjyBP6fn3R9zT8KiML

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaf591220d6075ab9638f2ddebc32f5fc1d996c359f8c3a9b1f056a7e46dd6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:04:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 356
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 143285
x-xss-protection: 0
last-modified: Mon, 24 Jan 2022 05:03:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 13:04:07 GMT

GET
H2 200 t_prism_sitemessages.php Show response
trackcmp.net/ 0
362 B 175ms
129ms Script
text/javascript 2606:4700::6812:10c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trackcmp.net/t_prism_sitemessages.php?trackid=1001840538&prismid=4b14c953-5107-48e4-8de1-96e0ddfe49ad&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro
Requested by: Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:10c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.1.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/7.1.33
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
content-type: text/javascript;charset=UTF-8
cache-control: no-cache, private
x-privacy-policy: You can find our privacy policy here: https://www.activecampaign.com/help/privacy-policy/
cf-ray: 6d73a84f0869926d-FRA
content-length: 0

GET
H3 200 container.html Show response
2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 48F1 6 KB
3 KB 49ms
20ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 02 Feb 2022 13:10:02 GMT
expires: Thu, 02 Feb 2023 13:10:02 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 t_prism_sitemessages.php Show response
trackcmp.net/ 0
37 B 135ms
131ms Script
text/javascript 2606:4700::6812:10c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://trackcmp.net/t_prism_sitemessages.php?trackid=800701871&prismid=59ee3481-e3c9-4321-b26b-df072209094c&url=https%3A%2F%2Fplusonbr.com%2Femprestimo%2Fcaixa-emprestimos-para-negativados-tudo-sobre%2F%3Futm_source%3DActiveCampaign%26utm_medium%3Demail%26utm_content%3D%25281%2529%2BProposta%2Bde%2BQuita%25C3%25A7%25C3%25A3o%26utm_campaign%3DEmpr%25C3%25A9stimo%2B84%2B-%2BAtividades%2BRecentes%2B-%2BPedro&email=yohannaoliveira851%40gmail.com
Requested by: Host: diffuser-cdn.app-us1.com
URL: https://diffuser-cdn.app-us1.com/diffuser/diffuser.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:10c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.1.33
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: PHP/7.1.33
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
p3p: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
content-type: text/javascript;charset=UTF-8
cache-control: no-cache, private
x-privacy-policy: You can find our privacy policy here: https://www.activecampaign.com/help/privacy-policy/
cf-ray: 6d73a8511da9926d-FRA
content-length: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0D8F 624 B
297 B 39ms
31ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT39QIQv8Sq9wEYiZnZvgEwAQ&v=APEucNUOedAtUYPjLSS6RhlBSWotmRoea4V_wG1G-sjnkkyW5ose9U3dGi_pzlG8jJRlmkrXJvo5NEWfS0YLJdknhvRXDfbCWxBRCCwpG-EfH0B0GL1Y2A7P3r_v5E1XzGDFltpsYz8BiGXWjR_7c9lXHZBLHYPhzkPujqN1lhFm6owNUH5jC1o

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 02 Feb 2022 13:10:03 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 abg_lite_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220131/r20110914/ Frame 48F1 19 KB
8 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220131/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d9c224b9a0613f2b32232c1692facdba66da6722645c311854999087539186d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 12:54:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 923
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7717
x-xss-protection: 0
server: cafe
etag: 3424151191822960849
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Feb 2022 12:54:40 GMT

GET
H3 200 omrhp_fy2019.js Show response
pagead2.googlesyndication.com/pagead/js/r20220131/r20110914/elements/html/ Frame 48F1 6 KB
3 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220131/r20110914/elements/html/omrhp_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2d0744b54be7eab148245653f8fad2e4a0e8875b886bcacbb2c70741872eda55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:02:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 474
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2626
x-xss-protection: 0
server: cafe
etag: 8548655983161038638
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Feb 2022 13:02:09 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 48F1 0
571 B 106ms
63ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsv3fmCRBC5oEscX_00oIbAozzO4lAA7ywjFHngQ6lcoFSAGCwO0PT89IfgMvD3l40kry9WNoChq2Yo-voMZyDSSBpst1BPb0RKLSeuBE3y6FjyXnbb-MrFDi4RcgDl8beZOH0FM3VDn5_-PVP86-90wcjLCxHy_hHpob7ZfMWKHpzg-imhCJwl717qRMwEg_W-u9bpqJFHZNBvwenIrkss4OSggjkcZmEGj2hrgiktxQom7VAVgEDLN7s6GObN-yWoGUYzZ7_COJs6xp0X0UJVejrnHSfua9cRSzOetzV3oxRBfwr0-_2CpBLp75TVylXHFpbQ__rmdIBR6aS0Lw1GkN7iqYYuysU3EdtfbrHJqhD8u5BeBY776Iiulq9Kn3rk0F3Lhx6ZdeGTVVej_G7YtkSs1zTp1w92X8d2sus-gXFKj0As2iTjubd3LHmu987boI-N-UtufhlXZjN6yHY6xqm-RbmHb-HW93n0DKXZKcW51O6LL2w9Kmr1AlLws1tP7zFbUIOo4W_i2Rqh94fWPab3yeX-TigbJ3x3sDcHUPYkAprzCnKKvCV1c4K_h8GPIXQi039VUSUyb1FMjoJz_QTpz3NdLAJ2yb-_XkNv7uleJrIz3WSdnvXhDFv9Re8r5BmDsqkG29Fr9o8XbJ2jZN2zdFiVBhGH2jY2fhQNnZG4exDnmtl6xevaikQcCnFt32ATeFT01UtZZmWUngqrZsAsPOurPJY68_jWdnIXQx0EWaNx3zYezeayMvjNClLqJMwg8-YKXlrNRD7xOvs7qoXxXCFU14gSumUnRiNM18ZUU_wrMAoDLXoWVdcl9Kj6O_sXzH5ohNciTYBHlCiLTrS0fT3IE0PDjhaCGSK0yBDqOtP2FwxpiA7JEAkODCpPJiNUlejBw-kBfT_YQOXZY7mEcpdCBPV7OPdE2vuiDQk6-dn8EmhOIhOnotz3chjVUxIoKYsvJTzwwrOcQw4HPdgln0zED6uLj2bFOPLYa4XAzqwektMO1uBwgdFfs5C3exfmR6WpPO1TCEkaXgg1lgKY8rMeQ8Y0tc4K1wjVAjhZ3lWKvivXZ6ZzFVZjtp-1y_6rEXqCt3EaVh5ekdLU1yBVfiUNW4osmOm6qWldiOiF5Sd1PC7joF-T0chR8GDsXbWaU2Os30o8xpSL1NyaRPBzZdtmpi8TqvoPm4bwJxHorjlPLuYuJGAQvMwvxWvQRgKokHr4eLA4dUGVWNbqZGJjQo4fMw959lmS1sfGUe3USdjwDl6V3LVKkYSsIh6jMqg&sai=AMfl-YSlvyM_K3OQl8GGV2r_Y3Bawn-Wrw0hRyh8_ZoPwkpc0Q7aaaLxKT1CyTj8nc-6NWQRbdw3jT08diwKrW4T0W4v9x2g7LCUwEjgRdMx5-hzDy-g8lxYfXrnG0DJ1F5B4j-g7tlrjyEbAprnNH283vUpqFgvB-e9hz5hMIXIFuF1G3_SXdFE12G8eN4-UPUkS5ExISPPPfGDz_Sj0h34qpOLclTKF3IGTe0dkY5QST-anX-6IzyTGd7YVyq-i7sgVYL5X0Hk832LZFUGcudwannBR5Xf-sjX6fwv1AW9-O4C0LVrh7_O4axDWCaFNWh7Y8Rubg&sig=Cg0ArKJSzL3tqfB5jpPYEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220131.80297&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 02 Feb 2022 13:10:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 48F1 41 KB
15 KB 67ms
21ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 30 Jan 2022 21:45:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 228284
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 30 Jan 2023 21:45:19 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 48F1 42 B
63 B 50ms
50ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BqMKaF5AZ9srfZ1kyFIVNVxCleuYnIxX7mfC-9BWbQNL62OcRg_Wdlt06AFE45raDERsTR9Nvllk9TiUqIlRafZKQ-5JzN97b_nyuoN31BrqYaXeI

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/ Frame 48F1 2 KB
1 KB 65ms
20ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/window_focus_fy2019.js

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 12:51:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Feb 2022 12:51:11 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 48F1 123 KB
38 KB 156ms
110ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

029e397f5091f72db15257548e07a6f9008457e90acb7cd22efbdb8264b2a592

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38373
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1643632328463892"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 02 Feb 2022 13:10:03 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/ Frame 48F1 14 KB
7 KB 63ms
19ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fde98a3e06f299a73b0a3eb6c095649b9c3f9c342596091936a4675fd6980a1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:00:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 554
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 17106829078744545694
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Feb 2022 13:00:49 GMT

GET
H2 200 17831747516054810513
s0.2mdn.net/simgad/ Frame 48F1 21 KB
21 KB 65ms
20ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/17831747516054810513

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2cc81e74912b94063f74979cbfd862df63c541458376af58d8f03200fec1428

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sat, 29 Jan 2022 10:03:22 GMT
x-content-type-options: nosniff
age: 356801
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21317
x-xss-protection: 0
last-modified: Wed, 29 Dec 2021 11:01:05 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 29 Jan 2023 10:03:22 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame F527 1 KB
749 B 18ms
18ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 02 Feb 2022 05:53:44 GMT
expires: Thu, 03 Feb 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 26179
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0D8F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENe2lqL39DDssBz9p63oSUc&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENe2lqL39DDssBz9p63oSUc&google_cver=1&C=1

43 B
894 B

24ms
24ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENe2lqL39DDssBz9p63oSUc&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT39QIQv8Sq9wEYiZnZvgEwAQ&v=APEucNUOedAtUYPjLSS6RhlBSWotmRoea4V_wG1G-sjnkkyW5ose9U3dGi_pzlG8jJRlmkrXJvo5NEWfS0YLJdknhvRXDfbCWxBRCCwpG-EfH0B0GL1Y2A7P3r_v5E1XzGDFltpsYz8BiGXWjR_7c9lXHZBLHYPhzkPujqN1lhFm6owNUH5jC1o
Protocol: HTTP/1.1
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:03 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 02 Feb 2022 13:10:03 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:03 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENe2lqL39DDssBz9p63oSUc&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 02 Feb 2022 13:10:03 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0D8F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YfqCq0CuSWhjxTKCfKC5jgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENe2lqL39DDssBz9p63oSUc&google_cver=1

43 B
1014 B

25ms
24ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENe2lqL39DDssBz9p63oSUc&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT39QIQv8Sq9wEYiZnZvgEwAQ&v=APEucNUOedAtUYPjLSS6RhlBSWotmRoea4V_wG1G-sjnkkyW5ose9U3dGi_pzlG8jJRlmkrXJvo5NEWfS0YLJdknhvRXDfbCWxBRCCwpG-EfH0B0GL1Y2A7P3r_v5E1XzGDFltpsYz8BiGXWjR_7c9lXHZBLHYPhzkPujqN1lhFm6owNUH5jC1o
Protocol: HTTP/1.1
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 02 Feb 2022 13:10:04 GMT

Redirect headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:03 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENe2lqL39DDssBz9p63oSUc&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 0D8F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPTL8HfVSByN6NGjhCRAusM&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEPTL8HfVSByN6NGjhCRAusM%26google_cver%3D1

43 B
1 KB

140ms
140ms

Image
image/gif

37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEPTL8HfVSByN6NGjhCRAusM%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMT39QIQv8Sq9wEYiZnZvgEwAQ&v=APEucNUOedAtUYPjLSS6RhlBSWotmRoea4V_wG1G-sjnkkyW5ose9U3dGi_pzlG8jJRlmkrXJvo5NEWfS0YLJdknhvRXDfbCWxBRCCwpG-EfH0B0GL1Y2A7P3r_v5E1XzGDFltpsYz8BiGXWjR_7c9lXHZBLHYPhzkPujqN1lhFm6owNUH5jC1o

Protocol

HTTP/1.1

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:04 GMT
X-Proxy-Origin: 84.19.175.165; 84.19.175.165; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 52bc0f99-984d-4752-9abb-b08bce1fd81b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:03 GMT
X-Proxy-Origin: 84.19.175.165; 84.19.175.165; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 421250f3-0ffa-4434-97ee-06792c8f9fa7
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEPTL8HfVSByN6NGjhCRAusM%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D8F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzkxOTE3Nzk0MDg3NjExNTMxNQ%3D%3D

170 B
188 B

29ms
29ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzkxOTE3Nzk0MDg3NjExNTMxNQ%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:04 GMT
X-Proxy-Origin: 84.19.175.165; 84.19.175.165; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8b12c7c8-9400-4ec9-ad8c-f0c4353235c3
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzkxOTE3Nzk0MDg3NjExNTMxNQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F527
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEJ6JcQb9vaKXvlUkyPi0Ag4&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEJ6JcQb9vaKXvlUkyPi0Ag4&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bzluZHlNd0cxTmZmb0Q1&google_gid=CAESEJ6JcQb9vaKXvlUkyPi0Ag4&google_cver=1&google_push=AYg5qPK1zm1SZGuFKDorqIFnZ9ZP7t8utxGjliYVsxXTmuB...

170 B
188 B

28ms
27ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bzluZHlNd0cxTmZmb0Q1&google_gid=CAESEJ6JcQb9vaKXvlUkyPi0Ag4&google_cver=1&google_push=AYg5qPK1zm1SZGuFKDorqIFnZ9ZP7t8utxGjliYVsxXTmuBarret3xbw9ThcRpuZIMYDXjoY51I5C_U_97EQuo_xZm29_-v8J9_T

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:03 GMT
Server: PingMatch/v2.0.30-702-g2925257#rel-ec2-master i-0a9739bdde9ce53f1@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bzluZHlNd0cxTmZmb0Q1&google_gid=CAESEJ6JcQb9vaKXvlUkyPi0Ag4&google_cver=1&google_push=AYg5qPK1zm1SZGuFKDorqIFnZ9ZP7t8utxGjliYVsxXTmuBarret3xbw9ThcRpuZIMYDXjoY51I5C_U_97EQuo_xZm29_-v8J9_T
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F527
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESELs4vsQe4jIEY-H1yBQO2jU&google_push=AYg5qPIsB3Hlcbo3MZUI_hzm1A0o0r5C-fsJNrNfcSmtgKP0KB-FKJAQ7J...

170 B
188 B

28ms
27ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESELs4vsQe4jIEY-H1yBQO2jU&google_push=AYg5qPIsB3Hlcbo3MZUI_hzm1A0o0r5C-fsJNrNfcSmtgKP0KB-FKJAQ7JlR1t0FPhq04CG73nUKxbVVprJvy11gkh2I_dbmX_r9

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:03 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1643807404.846959,VS0,VE89
x-served-by: cache-hhn4051-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESELs4vsQe4jIEY-H1yBQO2jU&google_push=AYg5qPIsB3Hlcbo3MZUI_hzm1A0o0r5C-fsJNrNfcSmtgKP0KB-FKJAQ7JlR1t0FPhq04CG73nUKxbVVprJvy11gkh2I_dbmX_r9
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame F527 70 B
265 B 147ms
49ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEBsWkELV0EXYFmgJG46uWt0&google_cver=1&google_push=AYg5qPJ2nabJOC2Dyh9SB4pg9obbwK9VrLnoVozSyZvAIO3IviXtgQsPDzXZNUUk60WIEd4hMmOzsJe1hAtKWv8dnr6eI8u1la7w
Requested by: Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:03 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F527
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESENg1tX73kHbsFqaakjBownE&google_cver=1&google_push=AYg5qPLIfSarpOE88_b3Ay882zGM5qmYH8fNfZ68uI_PFrDUO_euPISQgR_QY2O7R3vXRLme5XQ8uWVjrQc...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLIfSarpOE88_b3Ay882zGM5qmYH8fNfZ68uI_PFrDUO_euPISQgR_QY2O7R3vXRLme5XQ8uWVjrQcIAL1LjnHgTYwGigY&google_hm=QlzwIfvVRDOP5TWd27HCrqU

170 B
188 B

74ms
36ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLIfSarpOE88_b3Ay882zGM5qmYH8fNfZ68uI_PFrDUO_euPISQgR_QY2O7R3vXRLme5XQ8uWVjrQcIAL1LjnHgTYwGigY&google_hm=QlzwIfvVRDOP5TWd27HCrqU

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:03 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPLIfSarpOE88_b3Ay882zGM5qmYH8fNfZ68uI_PFrDUO_euPISQgR_QY2O7R3vXRLme5XQ8uWVjrQcIAL1LjnHgTYwGigY&google_hm=QlzwIfvVRDOP5TWd27HCrqU
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dot.gif
s0.2mdn.net/ Frame F527 43 B
184 B 51ms
51ms Image
image/gif 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESELiaqFYoX6IBIP5vewG-CP0&google_cver=1&google_push=AYg5qPKHTF4v8ZyEIkDhR76Xj_ghn8r_JM-RYiBT7tPIlUbgQMhrKsJyn5D8voiW5igQ6uFn9KZYCe85WMXNz17wXubFI13H29yW

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 03 Feb 2022 13:10:03 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame F527
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEA_IudkSaOxOCYr_gExn2uY&google_cver=1&google_push=AYg5qPLJ8zfkhdTohksg1vRjWb7mYjdc4udMsfltrX4lgWt9m7SyvFEip76EX8uGvS-bj7P73IJ0B1_8S67V4VkSIEgg_1ABqB_9
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&cmp_cs=&us_privacy=&sync=1&google_push=AYg5qPLJ8zfkhdTohksg1vRjWb7mYjdc4udMsfltrX4lgWt9m7SyvFEip76EX8uGvS-bj7P73IJ0B1_8S67V4VkSIEgg_1ABqB_9&goog...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDM4NjE4MjY1NjM2MjE2MzI2ODA3Mg%3D%3D&google_push=AYg5qPLJ8zfkhdTohksg1vRjWb7mYjdc4udMsfltrX4lgWt9m7SyvFEi...

170 B
188 B

62ms
36ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDM4NjE4MjY1NjM2MjE2MzI2ODA3Mg%3D%3D&google_push=AYg5qPLJ8zfkhdTohksg1vRjWb7mYjdc4udMsfltrX4lgWt9m7SyvFEip76EX8uGvS-bj7P73IJ0B1_8S67V4VkSIEgg_1ABqB_9

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:03 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=NDM4NjE4MjY1NjM2MjE2MzI2ODA3Mg%3D%3D&google_push=AYg5qPLJ8zfkhdTohksg1vRjWb7mYjdc4udMsfltrX4lgWt9m7SyvFEip76EX8uGvS-bj7P73IJ0B1_8S67V4VkSIEgg_1ABqB_9
date: Wed, 02 Feb 2022 13:10:03 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2 200 dot.gif
s0.2mdn.net/ Frame F527 43 B
101 B 52ms
52ms Image
image/gif 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEGVOn88jSN1MJcC6pvaJWW0&google_cver=1&google_push=AYg5qPI2-_RYOzPyh_0cGBBa6wBU_vfTXuSu88KZ63s2kwTHBysSAMhOh-z3ZsXf-iBcQ_fNB2-4PPQ0ff4xJndMBRamF2orBqjzGw

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 03 Feb 2022 13:10:03 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame F527 0
223 B 52ms
25ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L56DHJQ8GZ8PVSVyNYoPTbMPnRb4WOrNB9DR3LSLXRy9a0Fca_p914iSWnupXuZTcoTqycSg

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:03 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 48F1 0
60 B 54ms
54ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 02 Feb 2022 13:10:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9035 22 KB
8 KB 53ms
22ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 29 Jan 2022 17:31:54 GMT
expires: Sun, 29 Jan 2023 17:31:54 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 329889
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 48F1 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 88bc6f3484b102bddca1ed36258d4ad5e6bb4a0c722a72702dc2b1c0aaaa61be

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 DhLxIvxe_zqkAVEA_yTUctP7nok4SIlUAmQRNhxnrsk.js Show response
pagead2.googlesyndication.com/bg/ Frame 9035 35 KB
13 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/DhLxIvxe_zqkAVEA_yTUctP7nok4SIlUAmQRNhxnrsk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e12f122fc5eff3aa4015100ff24d472d3fb9e8938488954026411361c67aec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 07:11:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21494
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13595
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 07:11:49 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 62ms
34ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220131&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

acaf80a899efdf6c135a1ce82c5e31d4e4a8238770cbacb903b8786436ca5029

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9763
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 88ms
88ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 02 Feb 2022 13:10:04 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame F47F 13 KB
5 KB 23ms
22ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 02 Feb 2022 13:04:46 GMT
expires: Thu, 02 Feb 2023 13:04:46 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 318
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CB4C 783 B
535 B 28ms
27ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

c9fa3ec47704692d7cabb00b552aeddf470a35bacccac354ae10a8a445990094

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-KcdaLQ6RKZxpHFoadwvl3A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Wed, 02 Feb 2022 13:10:04 GMT
date: Wed, 02 Feb 2022 13:10:04 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-KcdaLQ6RKZxpHFoadwvl3A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9035 0
20 B 54ms
54ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BQMPWq4L6YcHwDMf83wPA9reABAAAAAA4AeAEAg&bg=!c3ClcDTNAAYZkRhwGZE7ACkAdvg8Wrork-E6On6RlFHgCAGNNw0Jz3TEnUm3q1YKMkQ-80-t3Ve58gIAAAByUgAAAAJoAQcKAFwsVYZKI8VEzxYd_gGr1TZewKUL0XkrvfdqX733LKW5HOTe7pwN-KR_JDZEOb9e6kL31fTzZQTZbzEDX-g13du6Ae_abvFvvdflHKTN6KbvePz5-7xxUAPoZGGW5JkC_68kBI95jWX33JvgLm38N4vqmUkgkS9_Ofek7UDXsp17wRkXFgExFL1rSlx7NWjFiVIwhBNXpUO2uqRK0b9GZnTun_0TNefa6wnuhpgUSvE0Cw_6IgepkC5kywuisxCrsU2XPg2sX8UsTf1KgDo5rfKrLXsVTbKBw3JfMiBglnvqooSJ2oGU0y5OkpyZ53VC6oBZUL_R8xqOdP_s-_HUDUBlV3XCW3IvnZH1YU-fceghFYJyFg_HCBmYs3Tg4Jbv1WyIgWcwWoe8np3U5SAb7oFljc4a08p7W4Lop5qYdgWSa2wVYRpxlOmnQq3ElMKzxu9a_ix-UWIrmVjIDSAbjdi6DhIcM2WGPmR3G8D2FVA1idpalGa9_1l8rzDKa0BYGpXJ7nQtDeIUFh17yhlJJ2vegk_gBGVaEmyeigm2oKCo8osgYO5OCqAMdP2FXfM26FTp5rQVRH8CIHSOSAqIdNBewC80y1jr5f39k_SjoXgDDk500M3jkh5_akEEoC3CzoZlPotOO3DVqV4zxIa-BrGSBuvWNtGLhkUMQoVnzRFLLaOmE062pDlDd1U88Hj2q9tsdx395Dym20RJszHmX-jluZBGpkFZlXR8tKDZnSwW0HN0AYB9WojigcPwN0c0hpsRSl-mmHMFMOLvEgIuVhq1Pl4QSXXgoTK81i40hxSFx0dCSaLimme1RPO6yBHSd146UvIyiyfJlPesoJPBkekZDFx8Ypt190pU5Nc6j1ijXWGkXKiPBeGWIu01qUhLWuwLfSdej2uB829cwk_8JDFV8eIIYSkNY5M8_Molu92-6R-IC3z4Qm2MFIrt_0175mTN7Lp30mjOda0_wjps6Tmgqt_uUu9bvISEjyiCZB71M8I1Z2tGe4F189lrhiZNQE-djtevLZ1TV7Od1utBaZQl97lY3cVfXskQ8QrHMBsQaDSXXXF5WWmBgmxYpFA5kLORv4HU6c0Zh_hMfcubQx7t0djpeaztEJYdNJFAIXfm474bJ0fFc6mfHa3KdS4y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2770 6 KB
3 KB 19ms
18ms Document
text/html 2a00:1450:4001:80e::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022012701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 02 Feb 2022 13:10:02 GMT
expires: Thu, 02 Feb 2023 13:10:02 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CB4C 0
0 60ms
60ms Image
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220131&jk=321971054602661&rc=null
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 DhLxIvxe_zqkAVEA_yTUctP7nok4SIlUAmQRNhxnrsk.js Show response
pagead2.googlesyndication.com/bg/ Frame F47F 35 KB
13 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/DhLxIvxe_zqkAVEA_yTUctP7nok4SIlUAmQRNhxnrsk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e12f122fc5eff3aa4015100ff24d472d3fb9e8938488954026411361c67aec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 07:11:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21495
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13595
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 07:11:49 GMT

GET
H3 200 error_handler.js Show response
tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/ Frame 2770 7 KB
3 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/error_handler.js

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e5572f9263b7fb2ad59192e15e1d769aa3fb9f70b1adb8ee1ce5e2b211ff14f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 01 Feb 2022 18:25:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 67468
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3390
x-xss-protection: 0
server: cafe
etag: 11425511688761482478
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 15 Feb 2022 18:25:36 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2770 42 B
63 B 53ms
53ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CC3yCob-ZWxkEZRr-VAZrKOppnYnkCt_uKg8N-pQr0zDLQktP3GGmeGh41D0zoyM0T04d4ArJGnEvNZ9vfCtdykI3SA-aDKr6rzbN142_NuLPTdNQ

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/ Frame 2770 2 KB
1 KB 57ms
28ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/window_focus_fy2019.js

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
Origin: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Feb 2022 13:10:04 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2770 123 KB
38 KB 99ms
72ms Script
text/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

029e397f5091f72db15257548e07a6f9008457e90acb7cd22efbdb8264b2a592

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38373
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1643632328463892"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 02 Feb 2022 13:10:04 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/ Frame 2770 14 KB
6 KB 57ms
29ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220131/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fde98a3e06f299a73b0a3eb6c095649b9c3f9c342596091936a4675fd6980a1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
Origin: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6195
x-xss-protection: 0
server: cafe
etag: 17106829078744545694
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Feb 2022 13:10:04 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2770 0
0 29ms
27ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTg9mCUlI1T1w52DYvSED9xZ10hYzmbLsNS2VDp7Dd0zBdOsNsxPLKx1mtQPoUHx-bQB4dLOjR9DzW9g4T3zlXs3OLcpA
Requested by: Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C84D 624 B
297 B 37ms
33ms Document
text/html 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYteHDmAEwAQ&v=APEucNXnATkU7Fjk2p87MPTD1MZ-AMnoXrQ2jsJBFi5Yr4P04x3ygX3V96nUUhCLXntI4zR3X9Uvs8zzgwtfhp9dP4mtRtOz2_3m1u1Jm44bd934A1XIJfQvJQSo_p_QJIKBwXe0k5RPLi83aJt8w6vAoPE7s5AW6UXGJ_oVO0aitJ9yQIfn4jk

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 02 Feb 2022 13:10:04 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2770 73 KB
31 KB 65ms
63ms Script
text/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJ32CBfU9lPGjGMj4fVprfDRgSQ4PzGyAvOkC-ZShtG2MEy_-z4jYPABPN4BLW2HRX2tMVThf_xhHOrgeDPDKEtrxOaUDnPJyaizQqTa9TBr-j0R4qpQD5kFl0fwC_ZIcSNVViSMPxw1WtqHGcSjDww35c9g&dbm_d=AKAmf-Bch2P2wZ7bWu-KmJOlhkx9HY1cd_EQuwvE805kE8B_s3TIjUiXkGBD9CRZzjbvZppOABp7dFdY0qVroSIM1L63lNe9jGegf8qb7rGPX7g3jDSUnGLfqNY7a-Dtipm_mTPPmflffxbDd-xcOkL1UzHvRR5qvCkZg4vdtfTrZBhxIGoD3YDRGlZlGY1Dw-5VSM0eeRwEzbj5wOmPT5y3p6E1SoOsFWRtd_ZDts1ageIu0-h-OB1pvBFApP1WL8cH1SVkTZLKUw8oFChXbSgDNzTgFLIoCWow9CE1C7z1l9SQIkjDg0id3XZaykK9v2j3WplI2xNz0GhV_7N26CFDkaRm8MZipLw6qCyv6_3nQC6KW9ZTb4EnGhk6rbdBa8kJbZoItHk2Mv_aUABInoDNROlAnkboHQhJpl-BAXcwNWPjFuvnJ5-oJkdqo95WkfTQ5GomFNXF8Shg6ilppJWY2yp33eHGYrA3gm6ysT6v2ExmMQSWS2iVOTbHnA-3gc_ijiPOG98owzruuh6d3Bf7lZIgmXZGhZeD9MtUSZRPDO8dT-kqfz8VBpyWPfP_FMywCV0RycSjOyAJwyKLdTFavjJYIJr3-iT280dYZO5nj5J63vlJli77cYgGg0W3PgkEVwTEEy-VdtkLxyag3odvzHAz7cQd9SLD76iQFNOlUoxsODUIgfrRuuG5G_J7DW4cZ3RsQORO4N-H1xRTPm3sHC-RAJzpOg0UaQTeW-5htktAgxHIfFRVI1uJ1Tf9VidlZGHGoV_zA3q4wSwiRFR1bqQFx5YnyfXbAHEkndipysyZIZz0EWPdhJKgt6aD9gjgSjagkIZJ4tZUc_gIqdufBLSoB32_bmod44NcLqImEwJaKoE5LUQKPcnqsXOSEztgy2ohixFi6ydWqJl_Fyxzp15jdMr899qSq74FaFiWu6kJmWmdX2LDUcExSB5Fg4cLktLxHunCSJD0rsXvOZHQkAhzUWAZPR37tJtzz_HR5qqvvg0mebTKq8xB_p81Fi2YDthDpSxj2Ev2EtytW1ZBzE0AsY8W5_MFVpVYIy6PCpNtFQTeXMN3nl-UFifjhDBRJsM3YylWhaA-r8HROJoK_d9pdKyEPUkuyFo6jNJw5LrM0JxztItLpiuJro4jZrZM9qxgUlMVf7Nc4nXbJQNumt7Tms8Y21u7HtU9vgz1gJ9z1rjMqbpn8cOrY9OSkTR6Nexrfd7s0HJiDbQIT7y-8cc1Ro8CoYHynv4RtLsQxtnXj1iCoO27OAlpuh3XreLOtWv8NsyUXQtO68ttBpOudZvSC8nyGthWCTXxDXaMm-D3od632cinFHAnL2T_WodRq0wSfHGGI3ESvq17mEhXb6Yi-XMuiwPaZe1ws7PZzNMvLHY2njg3zGUizFBs5KqOLi1Pjn63MSHEIvTCvc7m5bGSpkj46GP_F-9vkacYMCQdbSdYfuyDSE97B1ZOwIBPI3UBaP8L_mWi4AkktqjhXcgiG94vU2ss0k5Z2TmkUdTezQ36FE1PtwBDCyBrVjjw5HU-sxTqIcObQDfScM8Aw7wZah7F35A1RpOTJDP1d0RyjjzpBsmCfUJrJAIfb3b8PqPLRsCRLYFQYeY8fqOqk0tRZqD9pziNxyahN4m5sgtcxpCMeAlmNou0BrmiNlCdBA8f1hCIOjqH06Ip6udEyaqOsYRdJt_l3RYaEZtnodt76L46SlLjZbbkchQRZLO4KDKfCtKbDErGk6kO6dqyP0wrCvBNJxVvdZhs5ZXfxgOEws2o7R9ZtgbIMKpngz6SGwj_igHwTIbNvyfD_f-JuaRu_SIk_opWNRDNwgib8sAqX7jMK8DdKGTG0PpthvbnJ1DkY8b5ZtkygJlgxUVuwwejWBZfE8e1EifljbAeOKjzk51e1Y_fmLvmfblU14lQvpLrnMwcxu3CAXNlOOYlmVSeWD1Bv-sEXO09HrPXJWZBpAMfp3huvDuvwusfKYBH49Xck8-6053O96_hb5uwvp44wt-6vGgp6WKHdnc-p6f7JuXsOpA1-hhzk0tdLA5MN8NZqEgOxaG9t_rHfITQ24RpGBDbuto9WrSrkFZSfYF_yQwpXkpp1JtuO0T2CLFKEK_iDZm5sGS5zz7A0XP-HDohqw4XUM2ZV84GQdgEjg4vFFMEOCGwhPtArGBM3JonZS_UvMZBkwgAdYGmv68UBuK7Zat0kOxuc2E80fNDxQWZlcYQt5xufzQbVCuQUmsVjI_pXLeF-iuWs5hDTD9nTpKvV_4s7bWL-1nFrcQqbGHom7YoWjMMQ9AXZVawew-wMgg_AeGSiCqggOPGPWsk0UvYBty6k21qSUl2SZGqfc-s-WctNocJfbJyAsKfnKehcOCffYqAQRyuTn6OYluMoiVi2IOZKfZiVhQGMnQkspRKq7PmQukhDS1Een1JbOixzUKJzJsl26za30v9Q2A9abmEpMC9ndCHEV7x1eBjeqCwhaWDUiGAfLD_swKpEi9qbc7KwQrvuUJgP0dAd5k3_Y9D7S9RxGb9EvnStxWO_h4WIDQ_uLKjLFJqL6-9AnLbtXWv-N2RNwVk7traqUvkgR5Zxe-VZD_J0icoya9_jthJ63bGNjAn7xTxcNJjCPpFQ4K23tAtDzDjADaCCnXqQ_RukVqJ5ciVFIHfCofaFI3U91lBlZYo-3_qq37X-6c9KtCFt8t_biRrvQZDX0NJJmgcN__UJIAEZuolg4RAM4KMLgNo2I8Zt-3wSdsWV1bAItqtNMNmZ7lNhfeS1LH63GY7WLpvBEMc5emAU_tQUeHuL2JsDjqfn1QTBA58Truu7Pl6TkB0Wm3DIexbo2gP-uquzS7ErsZAXVmMhUbWfDxvosZ8vDCsKTIomHN2aNI9FuhdGen_OIHHgb2CJSwJsz5U8GEp9G-xN9dbfggntMF7BtKmGyMGeg8lP3zOjmUY-KjV-Xk76PFyex7ksPl_Uih32h34rAyZug6IIrXTtxMjbpTvuQsG-mOlU3JOW-ESTY3q35VwK0k7pcHPcVr5ERdksdYVad1-VNijWqhKLNqGZuMw5-kngR6K2CB7OZgwAdZ0ofto3wIBRbm1z9xCW7oXPKELAgkuqa0aQfx5jPP2qdZRzmGv3YcdlLYKXTEhfxRU1iBFoZUwFEiIEQMiqo5sp0I7vd6oNdYoKiOykwp1j3EjSWsdHVftXwXclCmXrd6sKDorTAflebgLcdNqjEk59PnrEEtsWsWLx4ScTjOGZU4lATiwm7n2iRDSSO7qCXD60RSUF3PAPJFjNXw8MkyWR3Z4KJeV5LJCf7mj2YtQlasWNM74SNNOIkRXW43qUZb7uV65OLywQMy27RGUWH9LmDa75H8xm5LoLI6awKyanYeM4U4&cid=CAASEuRoo2UFFKzVjk2tw32N8QZ0rw&rfl=1%2Chttps%253A%252F%252Fplusonbr.com%252Femprestimo%252Fcaixa-emprestimos-para-negativados-tudo-sobre%252F%253Futm_source%253DActiveCampaign%2526utm_medium%253Demail%2526utm_content%253D%2525281%252529%252BProposta%252Bde%252BQuita%2525C3%2525A7%2525C3%2525A3o%2526utm_campaign%253DEmpr%2525C3%2525A9stimo%252B84%252B-%252BAtividades%252BRecentes%252B-%252BPedro%240

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2600f2570d69d551910225b6c300b08992b5bd65015aef3594afe093c2eac5af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31733
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C84D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKbIgUiLVLqDHuEo7eBL6YI&google_cver=1

43 B
894 B

25ms
25ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKbIgUiLVLqDHuEo7eBL6YI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYteHDmAEwAQ&v=APEucNXnATkU7Fjk2p87MPTD1MZ-AMnoXrQ2jsJBFi5Yr4P04x3ygX3V96nUUhCLXntI4zR3X9Uvs8zzgwtfhp9dP4mtRtOz2_3m1u1Jm44bd934A1XIJfQvJQSo_p_QJIKBwXe0k5RPLi83aJt8w6vAoPE7s5AW6UXGJ_oVO0aitJ9yQIfn4jk
Protocol: HTTP/1.1
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 02 Feb 2022 13:10:04 GMT

Redirect headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKbIgUiLVLqDHuEo7eBL6YI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C84D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YfqCq0CuSWhjxTKCfKC5jgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKbIgUiLVLqDHuEo7eBL6YI&google_cver=1

43 B
894 B

25ms
24ms

Image
image/gif

184.30.24.241
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKbIgUiLVLqDHuEo7eBL6YI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYteHDmAEwAQ&v=APEucNXnATkU7Fjk2p87MPTD1MZ-AMnoXrQ2jsJBFi5Yr4P04x3ygX3V96nUUhCLXntI4zR3X9Uvs8zzgwtfhp9dP4mtRtOz2_3m1u1Jm44bd934A1XIJfQvJQSo_p_QJIKBwXe0k5RPLi83aJt8w6vAoPE7s5AW6UXGJ_oVO0aitJ9yQIfn4jk
Protocol: HTTP/1.1
Server: 184.30.24.241 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a184-30-24-241.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 02 Feb 2022 13:10:04 GMT

Redirect headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKbIgUiLVLqDHuEo7eBL6YI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C84D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIylsdph1Ay8azz24zZGFeA&google_cver=1

43 B
1016 B

22ms
22ms

Image
image/gif

37.252.172.249
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIylsdph1Ay8azz24zZGFeA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPDkLxDD7WMYteHDmAEwAQ&v=APEucNXnATkU7Fjk2p87MPTD1MZ-AMnoXrQ2jsJBFi5Yr4P04x3ygX3V96nUUhCLXntI4zR3X9Uvs8zzgwtfhp9dP4mtRtOz2_3m1u1Jm44bd934A1XIJfQvJQSo_p_QJIKBwXe0k5RPLi83aJt8w6vAoPE7s5AW6UXGJ_oVO0aitJ9yQIfn4jk

Protocol

HTTP/1.1

Server

37.252.172.249 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:04 GMT
X-Proxy-Origin: 84.19.175.165; 84.19.175.165; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 880ca0f9-2f10-4a52-8fce-a8a4334fbecb
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIylsdph1Ay8azz24zZGFeA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C84D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA2Mzc2MzkzMjQwMDA0MzI4Mw%3D%3D

170 B
188 B

27ms
26ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA2Mzc2MzkzMjQwMDA0MzI4Mw%3D%3D

Requested by

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 02 Feb 2022 13:10:04 GMT
X-Proxy-Origin: 84.19.175.165; 84.19.175.165; 534.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6c14796c-3547-4eb8-a1f3-e9e9362de474
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA2Mzc2MzkzMjQwMDA0MzI4Mw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame F47F 0
9 B 18ms
18ms Image
text/plain 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?9Ya82w
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 2770 106 KB
37 KB 46ms
19ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
Origin: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 10:21:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10088
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 03 Feb 2022 10:21:56 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220131/r20110914/elements/html/ Frame 2770 8 KB
3 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220131/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJ32CBfU9lPGjGMj4fVprfDRgSQ4PzGyAvOkC-ZShtG2MEy_-z4jYPABPN4BLW2HRX2tMVThf_xhHOrgeDPDKEtrxOaUDnPJyaizQqTa9TBr-j0R4qpQD5kFl0fwC_ZIcSNVViSMPxw1WtqHGcSjDww35c9g&dbm_d=AKAmf-Bch2P2wZ7bWu-KmJOlhkx9HY1cd_EQuwvE805kE8B_s3TIjUiXkGBD9CRZzjbvZppOABp7dFdY0qVroSIM1L63lNe9jGegf8qb7rGPX7g3jDSUnGLfqNY7a-Dtipm_mTPPmflffxbDd-xcOkL1UzHvRR5qvCkZg4vdtfTrZBhxIGoD3YDRGlZlGY1Dw-5VSM0eeRwEzbj5wOmPT5y3p6E1SoOsFWRtd_ZDts1ageIu0-h-OB1pvBFApP1WL8cH1SVkTZLKUw8oFChXbSgDNzTgFLIoCWow9CE1C7z1l9SQIkjDg0id3XZaykK9v2j3WplI2xNz0GhV_7N26CFDkaRm8MZipLw6qCyv6_3nQC6KW9ZTb4EnGhk6rbdBa8kJbZoItHk2Mv_aUABInoDNROlAnkboHQhJpl-BAXcwNWPjFuvnJ5-oJkdqo95WkfTQ5GomFNXF8Shg6ilppJWY2yp33eHGYrA3gm6ysT6v2ExmMQSWS2iVOTbHnA-3gc_ijiPOG98owzruuh6d3Bf7lZIgmXZGhZeD9MtUSZRPDO8dT-kqfz8VBpyWPfP_FMywCV0RycSjOyAJwyKLdTFavjJYIJr3-iT280dYZO5nj5J63vlJli77cYgGg0W3PgkEVwTEEy-VdtkLxyag3odvzHAz7cQd9SLD76iQFNOlUoxsODUIgfrRuuG5G_J7DW4cZ3RsQORO4N-H1xRTPm3sHC-RAJzpOg0UaQTeW-5htktAgxHIfFRVI1uJ1Tf9VidlZGHGoV_zA3q4wSwiRFR1bqQFx5YnyfXbAHEkndipysyZIZz0EWPdhJKgt6aD9gjgSjagkIZJ4tZUc_gIqdufBLSoB32_bmod44NcLqImEwJaKoE5LUQKPcnqsXOSEztgy2ohixFi6ydWqJl_Fyxzp15jdMr899qSq74FaFiWu6kJmWmdX2LDUcExSB5Fg4cLktLxHunCSJD0rsXvOZHQkAhzUWAZPR37tJtzz_HR5qqvvg0mebTKq8xB_p81Fi2YDthDpSxj2Ev2EtytW1ZBzE0AsY8W5_MFVpVYIy6PCpNtFQTeXMN3nl-UFifjhDBRJsM3YylWhaA-r8HROJoK_d9pdKyEPUkuyFo6jNJw5LrM0JxztItLpiuJro4jZrZM9qxgUlMVf7Nc4nXbJQNumt7Tms8Y21u7HtU9vgz1gJ9z1rjMqbpn8cOrY9OSkTR6Nexrfd7s0HJiDbQIT7y-8cc1Ro8CoYHynv4RtLsQxtnXj1iCoO27OAlpuh3XreLOtWv8NsyUXQtO68ttBpOudZvSC8nyGthWCTXxDXaMm-D3od632cinFHAnL2T_WodRq0wSfHGGI3ESvq17mEhXb6Yi-XMuiwPaZe1ws7PZzNMvLHY2njg3zGUizFBs5KqOLi1Pjn63MSHEIvTCvc7m5bGSpkj46GP_F-9vkacYMCQdbSdYfuyDSE97B1ZOwIBPI3UBaP8L_mWi4AkktqjhXcgiG94vU2ss0k5Z2TmkUdTezQ36FE1PtwBDCyBrVjjw5HU-sxTqIcObQDfScM8Aw7wZah7F35A1RpOTJDP1d0RyjjzpBsmCfUJrJAIfb3b8PqPLRsCRLYFQYeY8fqOqk0tRZqD9pziNxyahN4m5sgtcxpCMeAlmNou0BrmiNlCdBA8f1hCIOjqH06Ip6udEyaqOsYRdJt_l3RYaEZtnodt76L46SlLjZbbkchQRZLO4KDKfCtKbDErGk6kO6dqyP0wrCvBNJxVvdZhs5ZXfxgOEws2o7R9ZtgbIMKpngz6SGwj_igHwTIbNvyfD_f-JuaRu_SIk_opWNRDNwgib8sAqX7jMK8DdKGTG0PpthvbnJ1DkY8b5ZtkygJlgxUVuwwejWBZfE8e1EifljbAeOKjzk51e1Y_fmLvmfblU14lQvpLrnMwcxu3CAXNlOOYlmVSeWD1Bv-sEXO09HrPXJWZBpAMfp3huvDuvwusfKYBH49Xck8-6053O96_hb5uwvp44wt-6vGgp6WKHdnc-p6f7JuXsOpA1-hhzk0tdLA5MN8NZqEgOxaG9t_rHfITQ24RpGBDbuto9WrSrkFZSfYF_yQwpXkpp1JtuO0T2CLFKEK_iDZm5sGS5zz7A0XP-HDohqw4XUM2ZV84GQdgEjg4vFFMEOCGwhPtArGBM3JonZS_UvMZBkwgAdYGmv68UBuK7Zat0kOxuc2E80fNDxQWZlcYQt5xufzQbVCuQUmsVjI_pXLeF-iuWs5hDTD9nTpKvV_4s7bWL-1nFrcQqbGHom7YoWjMMQ9AXZVawew-wMgg_AeGSiCqggOPGPWsk0UvYBty6k21qSUl2SZGqfc-s-WctNocJfbJyAsKfnKehcOCffYqAQRyuTn6OYluMoiVi2IOZKfZiVhQGMnQkspRKq7PmQukhDS1Een1JbOixzUKJzJsl26za30v9Q2A9abmEpMC9ndCHEV7x1eBjeqCwhaWDUiGAfLD_swKpEi9qbc7KwQrvuUJgP0dAd5k3_Y9D7S9RxGb9EvnStxWO_h4WIDQ_uLKjLFJqL6-9AnLbtXWv-N2RNwVk7traqUvkgR5Zxe-VZD_J0icoya9_jthJ63bGNjAn7xTxcNJjCPpFQ4K23tAtDzDjADaCCnXqQ_RukVqJ5ciVFIHfCofaFI3U91lBlZYo-3_qq37X-6c9KtCFt8t_biRrvQZDX0NJJmgcN__UJIAEZuolg4RAM4KMLgNo2I8Zt-3wSdsWV1bAItqtNMNmZ7lNhfeS1LH63GY7WLpvBEMc5emAU_tQUeHuL2JsDjqfn1QTBA58Truu7Pl6TkB0Wm3DIexbo2gP-uquzS7ErsZAXVmMhUbWfDxvosZ8vDCsKTIomHN2aNI9FuhdGen_OIHHgb2CJSwJsz5U8GEp9G-xN9dbfggntMF7BtKmGyMGeg8lP3zOjmUY-KjV-Xk76PFyex7ksPl_Uih32h34rAyZug6IIrXTtxMjbpTvuQsG-mOlU3JOW-ESTY3q35VwK0k7pcHPcVr5ERdksdYVad1-VNijWqhKLNqGZuMw5-kngR6K2CB7OZgwAdZ0ofto3wIBRbm1z9xCW7oXPKELAgkuqa0aQfx5jPP2qdZRzmGv3YcdlLYKXTEhfxRU1iBFoZUwFEiIEQMiqo5sp0I7vd6oNdYoKiOykwp1j3EjSWsdHVftXwXclCmXrd6sKDorTAflebgLcdNqjEk59PnrEEtsWsWLx4ScTjOGZU4lATiwm7n2iRDSSO7qCXD60RSUF3PAPJFjNXw8MkyWR3Z4KJeV5LJCf7mj2YtQlasWNM74SNNOIkRXW43qUZb7uV65OLywQMy27RGUWH9LmDa75H8xm5LoLI6awKyanYeM4U4&cid=CAASEuRoo2UFFKzVjk2tw32N8QZ0rw&rfl=1%2Chttps%253A%252F%252Fplusonbr.com%252Femprestimo%252Fcaixa-emprestimos-para-negativados-tudo-sobre%252F%253Futm_source%253DActiveCampaign%2526utm_medium%253Demail%2526utm_content%253D%2525281%252529%252BProposta%252Bde%252BQuita%2525C3%2525A7%2525C3%2525A3o%2526utm_campaign%253DEmpr%2525C3%2525A9stimo%252B84%252B-%252BAtividades%252BRecentes%252B-%252BPedro%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
Origin: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Feb 2022 13:10:04 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220131/r20110914/ Frame 2770 24 KB
9 KB 30ms
29ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220131/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3fa038660bda739cd06e007628e1d7b8ad1d300aff5c9acce85e73f9ecacc2ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
Origin: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9488
x-xss-protection: 0
server: cafe
etag: 10429589367799073301
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 16 Feb 2022 13:10:04 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 53ms
53ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220131&jk=321971054602661&bg=!qaqlqu7NAAYZkRhwGZE7ACkAdvg8WmH_e1zBouhBBsA_1wazWCCelIQuKBYbOLzoS9ENge1JAQAsngIAAABqUgAAAAJoAQcKABwJcr_8BeVsuA6rlF3eZ7zbZb5wOipj_nz9-wQLmQKnPuZQ_BdX5KyC-gRbSoyD0kx0v9zmSLklsx2kJctL74-E2IyV6s92NXDWpGIq0c3H2f0aESPjt5L8YkRxReV7uuMXY_vwt32302l-aCGwbUypTmpRWv1WNn1X_sEEXkasCXCkfhiNBbC62KB_9O3Y_DD2LGY4Q7vyerzpNMuiQTZtfRqk5XWkC1C-fvzqOQFYYdosgSK-c8IrqKPyXXp6ou56te1QOd9FoXCKzlJOr7WvTVZyzOKwONnd7nmDFnwOyo5eGD5L-Z7TZ5J2Y0SdvNABzYIYtFsqIiOTSb3qfvqg9AkurW_qlU6TdCPFtQOxbQg7hmEfPXsb4WUtQ-T4EH1NvU1lzgEQ9eX65lf6BB0nmo_YKv1JUVJNhMKIMT3dxV3eyLrF0TAdcac-2l1Aqh-g9-WUcNPqwt1wAYnrkT0xiK7M8mYGU2LLPQvyDQsVRy1nc0H1SRyfINP-KCJtLEcjhij1-27qvgEFdG9zUhLLXz4FGn6LeRLUwjBltB-gxpOwzNKp9VwCLMNvcb9hkfOONX0bHwjCuDHJrNQYKxRrhLuH5H5ANpsBTLt3MBgSjJoMWVMhyfKBZzfmXt6Vo1kggHwfWZVKL-z_VACTb7TK5yoOOROMEhpHaER98W-VvHleA4qA5D7UgeEyplrYqKpA9SxisaUOgjNdkDIxy_pWGGrXOhpvmW0tOJmMEPQj_WOahj7zYy8etlN1lt-9iduBBsyU9Usb_OZ67utZG8TL0rsB0xfGYx5RWUxMxmF0ZElwZOGew9RyCA30eejpZVczhaSCPoDvX1F2GVFg7z1YMQt9jEhSNa_3eJYBA6hdGCCDS9-YkJVpNpaXGJujlyTxpKqR5Z9e07HPu34UXJpPMaQoPN1zBsAyeHRYgspelwJC_ccPoQ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://plusonbr.com/emprestimo/caixa-emprestimos-para-negativados-tudo-sobre/?utm_source=ActiveCampaign&utm_medium=email&utm_content=%281%29+Proposta+de+Quita%C3%A7%C3%A3o&utm_campaign=Empr%C3%A9stimo+84+-+Atividades+Recentes+-+Pedro
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2770 41 KB
15 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Sun, 30 Jan 2022 21:45:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 228285
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Mon, 30 Jan 2023 21:45:19 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2061 1 KB
749 B 18ms
17ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Wed, 02 Feb 2022 05:53:44 GMT
expires: Thu, 03 Feb 2022 05:53:44 GMT
cache-control: public, max-age=86400
age: 26180
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 2770 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 03ad50496a2d7ba6c7a5e2ecc8cf3526753ff5f1e5b09b00f5ff7ac5577616ca

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17749318905346090584/ Frame 98C7 75 KB
19 KB 57ms
26ms Document
text/html 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17749318905346090584/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75b1441b3ee86f3188e1909ca0a717e6fd848019381e41c6728dac96d804748d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
content-length: 19671
date: Mon, 31 Jan 2022 12:19:38 GMT
expires: Tue, 31 Jan 2023 12:19:38 GMT
cache-control: public, max-age=31536000
age: 175826
last-modified: Mon, 17 Jan 2022 12:01:35 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2770 0
24 B 121ms
92ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvPObe02cEWL04NBuQCHjfAfaQOfYYeQuIk1fCEP_c11KqAdsP4zfhsQukZP1lm0vuPdXkJbkMu4Y24ZTNfi_1CJy3qu9BXKLqxrHYsGIxuGWMJxGDmHzJoSinJAQEYVEUNMxWQiV9ztaCBsv6BZiWAmA8bdv76Yt8BPfEqqEeEmbyzz3plccT9-dG88_7J5wP5Bx8hg7P4AwnOW0iORzFm0KAiJAUvdfr5nnkvgRFgbFIQ_H6j9TNbuU0hm-AM8-CY170HUhGTC_Ld0n5dTBJN2UBMP6xv3TdL0tmPP3m7qBuRKDXTY-GK7lGlQhGfPLGKT0O_yGOco2u8C8Vbq5U88OnvUJjhPU2m2lP5rlMp90zo9SBkIdAXjC2si2MVhRTlrwQedknIYg88P6id_VDCfNcGlz5l1FRbrjT_dgC0KjRt2ehNiLGfzwK9C0wR26CJxBAfCNPvc1b6rUAmW8c5Rc0xxgs0F5IpeC6vzxPYQ-9Hf_h6qdwSv2VQbwL-NQlbiw4BLBG8LWesWY9iljjqHEfvLrti0ctR3WFDo5wi1-Ub3A_m0hd3BT5I6-TI0o13AMKrP-WHIGkeFx0-YnEbqv2egm7K8LGIPJeBlrB10gHyckO-HP9yqcEwxRxg2dSwh_5Vbs874_Xjkyfz37zAvZLHWnW8QmfwaYE2eaRzRtaQ3771jb4UkB56wRzluwKtq43tVT_0AXHhS_EvdLuFhJGSuUApQsjs9NCn934l1H32IEFoRiBP3jrbYAHLhm44qiD_Nc6G4DAhZXWDibDKJ7K1xH2E19sUDX2yEOHKR777oInpkIhgMSd7XBnyF4RxVZSog5k_2NAvqqAvlnRemdeq8JHoHrZMmNBFiW5bF7E07WOr9SP6hTjc65gFs0InJZXDw3VJ1MF6ER3pFd-NNLacvpl7mAbIEzMSdFgTDQUpHecJivIGyXTLQCedawS658Dc1w4hshI-Z1OE70JwxVaKaxGZ3SMSfKmiZXD2iwdXLu0sSv_i-8pWcJEEugOY9TIPOcl9_UsiR847VGWs7mRZDoKajQwDr3iR4MfTrKVelijB6BRQk4dTKaxevNELqmZTH_T_EbTXj-ZfyMO10LOjJr5TG3cZGVTJNV87et-8ta27FQBERohgeZpHFIR70Ra-AonM46N3vjj_4Vw_X4HWaPr67hREcMqtqRFYd9ElnCMpIfuch7jtIQAKRGpInSLH6mVgTHJG51-rg4m9Vg6_7Q&sai=AMfl-YQ-V3afR726nYQ-Y7OBxjYhmvQaeT7vZ_NJbNJjA5IoqjdpXizLWqOVYDX8nRWeaUIvofSqRzhu1HNOWQNU3766LQqQMzJEZmMVsGyxqlzXSXZfBI_GkujK9hYpFWFSbo6UNL7-jFazCQBmoBGbEDtcu58dGROZWiZc2fmq3gwOJ-fnP1an&sig=Cg0ArKJSzCFv0mLqDmUXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=76&cbvp=1&cstd=73&cisv=r20220131.99902&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 02 Feb 2022 13:10:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 4450 22 KB
8 KB 22ms
22ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Sat, 29 Jan 2022 17:31:54 GMT
expires: Sun, 29 Jan 2023 17:31:54 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 329890
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 2061 0
104 B 149ms
48ms Image
text/plain 2a02:fa8:8806:13::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEITGlEvfUTU7nv3YbSUqKT4&google_cver=1&google_push=AYg5qPJRvaPrQJ7Y3FiRxaS0BL4xPDi5gZvuj7T_TCy78OAZELxUkEa5EsBXSlMVmCw81yxRnK1dbMUusDgUUKOLN-Rpgr2i2EW4
Requested by: Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 2061 70 B
264 B 49ms
48ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESENC373iFfYqYH_E1XCSjphc&google_cver=1&google_push=AYg5qPLjfmDNc6fjMzovaxQLmLyynQoaAA-fnKwbsnZAaKMmht0Au4e7HWeK4QLm6Qp7_4YFqrdB_oFpQAmVzEcC0Y6qd4IhdT-3
Requested by: Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2061
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEO1EuIuuNHS0nG0L2xoqSMc&google_cver=1&google_push=AYg5qPIuMdk-T8iHWCBrkvHLZ9Uq8TXwlbO-iLPudYxD-4ZlPqnXSZFoTeSk51mvBcdScbbYeSwRb0891f2GJt17...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=jwof5SV6TMGemQdtZqSX1A2&google_push=AYg5qPIuMdk-T8iHWCBrkvHLZ9Uq8TXwlbO-iLPudYxD-4ZlPqnXSZFoTeSk51mvBcdScbbYeSwRb0891f2GJt17mHq5GDDIWSo

170 B
188 B

28ms
28ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=jwof5SV6TMGemQdtZqSX1A2&google_push=AYg5qPIuMdk-T8iHWCBrkvHLZ9Uq8TXwlbO-iLPudYxD-4ZlPqnXSZFoTeSk51mvBcdScbbYeSwRb0891f2GJt17mHq5GDDIWSo

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 02 Feb 2022 13:10:04 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=jwof5SV6TMGemQdtZqSX1A2&google_push=AYg5qPIuMdk-T8iHWCBrkvHLZ9Uq8TXwlbO-iLPudYxD-4ZlPqnXSZFoTeSk51mvBcdScbbYeSwRb0891f2GJt17mHq5GDDIWSo
x-host: tde-deliveryengine-production-655df8fcc8-kqp9c
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2061
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEP8Br2DSVDwNcUUNIxaSCfI&google_cver=1&google_push=AYg5qPL0yX0zLA9f3BRekN42p9yesoeQQ14NXmRFNiycXT1gK6Dwy5RVZwUkjMjFfIRuZae-jG8bQVRcYXtrlDnjhuOktk7...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPL0yX0zLA9f3BRekN42p9yesoeQQ14NXmRFNiycXT1gK6Dwy5RVZwUkjMjFfIRuZae-jG8bQVRcYXtrlDnjhuOktk7PwOY&google_hm=MTg0NzgzMjk1NzA0MDQwNTE...

170 B
188 B

30ms
29ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPL0yX0zLA9f3BRekN42p9yesoeQQ14NXmRFNiycXT1gK6Dwy5RVZwUkjMjFfIRuZae-jG8bQVRcYXtrlDnjhuOktk7PwOY&google_hm=MTg0NzgzMjk1NzA0MDQwNTE4Ng%3D%3D

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 02 Feb 2022 13:10:04 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPL0yX0zLA9f3BRekN42p9yesoeQQ14NXmRFNiycXT1gK6Dwy5RVZwUkjMjFfIRuZae-jG8bQVRcYXtrlDnjhuOktk7PwOY&google_hm=MTg0NzgzMjk1NzA0MDQwNTE4Ng%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 2061 43 B
65 B 74ms
60ms Image
image/gif 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEMK51dFsg3dnIYufISQPvgE&google_cver=1&google_push=AYg5qPLlFae8D1pWyMinGApkrBX4TiqmW7G2r6zfaTUuE-CQlG9-mVnoB3JLD7tLNTBfVIUIBFAi8YEiNf1k_6eypLMRf60eo_9k

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 03 Feb 2022 13:10:04 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2061
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEBKCzkpdImNfDUnPchtRAVU&google_cver=1&google_push=AYg5qPIH6r271_RAcZEDW3bV6U83zoaTmEiMEjFnAxiIGPDGOIqaOO4coT3Ne-3JGkWFYaF1e6-JLr0I5osg_QFr...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIH6r271_RAcZEDW3bV6U83zoaTmEiMEjFnAxiIGPDGOIqaOO4coT3Ne-3JGkWFYaF1e6-JLr0I5osg_QFrPQcLp-7TrXE

170 B
188 B

32ms
32ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIH6r271_RAcZEDW3bV6U83zoaTmEiMEjFnAxiIGPDGOIqaOO4coT3Ne-3JGkWFYaF1e6-JLr0I5osg_QFrPQcLp-7TrXE

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 02 Feb 2022 13:10:04 GMT
via: 1.1 c6b364b1181abfafd7a69f210841edca.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA6-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPIH6r271_RAcZEDW3bV6U83zoaTmEiMEjFnAxiIGPDGOIqaOO4coT3Ne-3JGkWFYaF1e6-JLr0I5osg_QFrPQcLp-7TrXE
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: uqYPFmYCP-XBu8AD_sqiOB4Fxj9lRWWmeQ_cPYcBPzuJmqVMai3WoA==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2061
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPwXELG5NcTKxrcWVtsbpoE&google_cver=1&google_push=AYg5qPJ_p_7cU1X6pX_GJKxFDXIGNJYXA5D7h1oqi3omoCd8krbYqkzO...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPwXELG5NcTKxrcWVtsbpoE&google_cver=1&google_push=AYg5qPJ_p_7cU1X6pX_GJKxFDXIGNJYXA5D7h1oqi3omoCd8krbYqkzO...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPwXELG5NcTKxrcWVtsbpoE&google_cver=1&google_push=AYg5qPJ_p_7cU1X6pX_GJKxFDXIGNJYXA5D7h1oqi3omoCd8krbYqk...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESEPwXELG5NcTKxrcWVtsbpoE&google_cver=1&google_push=AYg5qPJ_p_7cU1X6pX_GJKxFDXIGNJYXA5D7h1oqi3omoCd8krbYqk...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2ZmQ2ZGIxOS04NDI5LTExZWMtYmZlMC0wNmYzNDQ5YjA0Zjg%3D&google_push=AYg5qPJ_p_7cU1X6pX_GJKxFDXIGNJYXA5D7h1oqi3omoCd8krbYqkzOpj-rs8UIVH...

170 B
188 B

36ms
35ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2ZmQ2ZGIxOS04NDI5LTExZWMtYmZlMC0wNmYzNDQ5YjA0Zjg%3D&google_push=AYg5qPJ_p_7cU1X6pX_GJKxFDXIGNJYXA5D7h1oqi3omoCd8krbYqkzOpj-rs8UIVHkAiIU7i0Hd3k_6bFIk8A8dHVJ3tt3ujHXK

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVA2ZmQ2ZGIxOS04NDI5LTExZWMtYmZlMC0wNmYzNDQ5YjA0Zjg%3D&google_push=AYg5qPJ_p_7cU1X6pX_GJKxFDXIGNJYXA5D7h1oqi3omoCd8krbYqkzOpj-rs8UIVHkAiIU7i0Hd3k_6bFIk8A8dHVJ3tt3ujHXK
date: Wed, 02 Feb 2022 13:10:04 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2061 0
12 B 28ms
28ms Image
text/html 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KYwTGxpvXN2JyByg7vIfEbeL3hbYOeDgwR2jgoB7tuXFMckzf-988JPsJbnQFo-2O7rOGeeQ

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 13:10:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 DhLxIvxe_zqkAVEA_yTUctP7nok4SIlUAmQRNhxnrsk.js Show response
pagead2.googlesyndication.com/bg/ Frame 4450 35 KB
13 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/DhLxIvxe_zqkAVEA_yTUctP7nok4SIlUAmQRNhxnrsk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e12f122fc5eff3aa4015100ff24d472d3fb9e8938488954026411361c67aec9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Wed, 02 Feb 2022 07:11:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 21495
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13595
x-xss-protection: 0
last-modified: Thu, 27 Jan 2022 13:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 02 Feb 2023 07:11:49 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 98C7 2 KB
1 KB 83ms
27ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17749318905346090584/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2973257313b8a6815336e3c045ab9814ece44936d58bf637175cd7047cfc9406

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 13:03:25 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 02 Feb 2022 13:10:04 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 02 Feb 2022 13:10:04 GMT

GET
H3 200 DcmEnabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 98C7 29 KB
10 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17749318905346090584/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

467a5b06cb117035f7882e8c71d80e093f04ce586c1ac2b84e7e4adf978edb30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17749318905346090584/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 01 Feb 2022 13:50:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 83962
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10136
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 02 Feb 2022 13:50:42 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 98C7 15 KB
15 KB 49ms
20ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 01 Feb 2022 20:07:55 GMT
x-content-type-options: nosniff
age: 61329
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 01 Feb 2023 20:07:55 GMT

GET
H3 200 Bte.png
s0.2mdn.net/sadbundle/17749318905346090584/ Frame 98C7 27 KB
27 KB 22ms
21ms Image
image/png 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17749318905346090584/Bte.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17749318905346090584/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f27cac9d16208911697db7e7a0ce9563fbb5a4988a0d2561af06ecbdb3e585e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17749318905346090584/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 12:19:49 GMT
x-content-type-options: nosniff
age: 175815
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27359
x-xss-protection: 0
last-modified: Mon, 17 Jan 2022 12:01:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 31 Jan 2023 12:19:49 GMT

GET
H3 200 Fnd_300x250.jpg
s0.2mdn.net/sadbundle/17749318905346090584/ Frame 98C7 19 KB
19 KB 37ms
37ms Image
image/jpeg 2a00:1450:4001:827::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17749318905346090584/Fnd_300x250.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17749318905346090584/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f655ee84ba912e5f2c42c70ca70d22413c6c895cc6b55f1c2f05f3607180aded

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17749318905346090584/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Mon, 31 Jan 2022 12:19:49 GMT
x-content-type-options: nosniff
age: 175815
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19621
x-xss-protection: 0
last-modified: Mon, 17 Jan 2022 12:01:35 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 31 Jan 2023 12:19:49 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4450 0
20 B 56ms
55ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B9PQ5rIL6Yd7KGpT43gOLj5jgBQAAAAA4AeAEAg&bg=!qaqlqu7NAAYZkRhwGZE7ACkAdvg8WshuDswu9tI68-SnrGdsZTqFNA014T8mIWVzhWihKPDlEI_negIAAAB0UgAAAAJoAQeZAvV_Vrbegl7QTOOcvRc0U48aFNXek46fNaXYPFI48lVKL4Q2c7gQxfcydOMYO3eM2QeNXWzLBnTvS4dm8PqlcfVUCdjWX2vQBDrgDskCFeoVrnjrcepOnkXTujUlF2Fq2u1k383O88zJ_WlsE5ZWn-C06PjTavgyIjJHZa1f21ObS74Rf-Jw_MR1bdKZCklyufkimJavw1qBdn_bLrdzWnNF4M5hEa38X_RWRM9A0E8Au_1ccCQ2mLot99a8O_jhUr47xk81MD7vqR_olK1umYMfXJxP73kKXTcgu0dMIIpLI1qiaCJqPvvNIt1FvkQOxtB2EE9Y4_ivfqNXaQWIA74EpFYSKDRCNMuy1Xz3VfbtZsyzUA4pvf7aFWJYc57W4Z37LS0h03h3PC0Y-GzUNOg4N-2eSxTffKbgIEqNtcY3t_g0ux_crtEcpVhbG7W72ycDygqxVf0rv3F4T0sy8UjsNk-67O2YJunoDDUkcpjmrQ2qBeEdPq1QwZAqDlfBJJDqk16-DKr1YLz5Bp9imxTDyaCGnplubmNJIlG6PYd_Zli2eQ5YvortppX7PCI41gCoXBCWNc2DDaqNZVnVMkFOF9rgg_c5pLzuJzqoviMOQVG5T_6Lr7uAstPeI7ka78XdFccFlAeZr64HOKUlu3AF6C8wCax_P0TrozZv54WqsfZOeEi1fSRAEt3rAw6fRSe26QX4rpAs7zd_iIKm3ib5mn7Xa7UDxuy5BxoLhqDiNcaYMQIsIZEZHt9GwJyA-JDPCAzAxAEq69heDR0ir80fdBiWW-XMTykB2ryOOQm63ZYMSaQPpbSpUh-YPvyicVYHJYQbMtJ6L-AL9HfBRZ04O76rU0Dp2OT-d4FiFCwDvFBrfP7Z8OoUjs0pv-LHib1F_K85KJa__nYo_rp-q-4JQCG_NyyzE4UpeRUhZBp7jQpmIB2JpMjbx3rqAw8d6T-nh863oiJeTtCu8DmE2KJIba-1xypGFL-euZqFnBq5FO1qZZQI

Requested by

Host: 2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com
URL: https://2056086279c4604e981803dfbd7def1c.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 02 Feb 2022 13:10:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2770 0
23 B 63ms
63ms Ping
image/gif 216.58.212.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvPObe02cEWL04NBuQCHjfAfaQOfYYeQuIk1fCEP_c11KqAdsP4zfhsQukZP1lm0vuPdXkJbkMu4Y24ZTNfi_1CJy3qu9BXKLqxrHYsGIxuGWMJxGDmHzJoSinJAQEYVEUNMxWQiV9ztaCBsv6BZiWAmA8bdv76Yt8BPfEqqEeEmbyzz3plccT9-dG88_7J5wP5Bx8hg7P4AwnOW0iORzFm0KAiJAUvdfr5nnkvgRFgbFIQ_H6j9TNbuU0hm-AM8-CY170HUhGTC_Ld0n5dTBJN2UBMP6xv3TdL0tmPP3m7qBuRKDXTY-GK7lGlQhGfPLGKT0O_yGOco2u8C8Vbq5U88OnvUJjhPU2m2lP5rlMp90zo9SBkIdAXjC2si2MVhRTlrwQedknIYg88P6id_VDCfNcGlz5l1FRbrjT_dgC0KjRt2ehNiLGfzwK9C0wR26CJxBAfCNPvc1b6rUAmW8c5Rc0xxgs0F5IpeC6vzxPYQ-9Hf_h6qdwSv2VQbwL-NQlbiw4BLBG8LWesWY9iljjqHEfvLrti0ctR3WFDo5wi1-Ub3A_m0hd3BT5I6-TI0o13AMKrP-WHIGkeFx0-YnEbqv2egm7K8LGIPJeBlrB10gHyckO-HP9yqcEwxRxg2dSwh_5Vbs874_Xjkyfz37zAvZLHWnW8QmfwaYE2eaRzRtaQ3771jb4UkB56wRzluwKtq43tVT_0AXHhS_EvdLuFhJGSuUApQsjs9NCn934l1H32IEFoRiBP3jrbYAHLhm44qiD_Nc6G4DAhZXWDibDKJ7K1xH2E19sUDX2yEOHKR777oInpkIhgMSd7XBnyF4RxVZSog5k_2NAvqqAvlnRemdeq8JHoHrZMmNBFiW5bF7E07WOr9SP6hTjc65gFs0InJZXDw3VJ1MF6ER3pFd-NNLacvpl7mAbIEzMSdFgTDQUpHecJivIGyXTLQCedawS658Dc1w4hshI-Z1OE70JwxVaKaxGZ3SMSfKmiZXD2iwdXLu0sSv_i-8pWcJEEugOY9TIPOcl9_UsiR847VGWs7mRZDoKajQwDr3iR4MfTrKVelijB6BRQk4dTKaxevNELqmZTH_T_EbTXj-ZfyMO10LOjJr5TG3cZGVTJNV87et-8ta27FQBERohgeZpHFIR70Ra-AonM46N3vjj_4Vw_X4HWaPr67hREcMqtqRFYd9ElnCMpIfuch7jtIQAKRGpInSLH6mVgTHJG51-rg4m9Vg6_7Q&sai=AMfl-YQ-V3afR726nYQ-Y7OBxjYhmvQaeT7vZ_NJbNJjA5IoqjdpXizLWqOVYDX8nRWeaUIvofSqRzhu1HNOWQNU3766LQqQMzJEZmMVsGyxqlzXSXZfBI_GkujK9hYpFWFSbo6UNL7-jFazCQBmoBGbEDtcu58dGROZWiZc2fmq3gwOJ-fnP1an&sig=Cg0ArKJSzCFv0mLqDmUXEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=320&vt=11&dtpt=244&dett=3&cstd=73&cisv=r20220131.99902&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS