wheregoes.com Open in urlscan Pro
138.197.62.132 Public Scan

Software

sffe /

Resource Hash

4d44b03d4e4d1df9a852bf35460f5584c94b37c52d08742682a1a03d20d2f6d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:01:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1875
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 126502
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 08:34:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 18 Mar 2023 12:01:42 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 94 B
719 B 42ms
20ms XHR
application/json 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=wheregoes.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3eb7350a0588ff4e1af60592b47c3a3c535379bf789126fcdf9737d2e80057e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0
expires: Fri, 18 Mar 2022 12:32:57 GMT

GET
H2 200 pp.js Show response
api-54-149-92-0.b2c.com/s/ 15 KB
6 KB 122ms
69ms Script
text/javascript 2606:4700:20::681a:623
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api-54-149-92-0.b2c.com/s/pp.js
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:623 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c5ca0a7a38656445f5bc5d37ad32ff89f0c5fd9b2f92ba604e698110787792ab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:57 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 18 Feb 2022 18:21:27 GMT
server: cloudflare
age: 4963
etag: W/"620fe3a7-3aa0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qWUO1gKlhBIb2nDa1h8P23Hm3jx95ZYouSFUGpWq7Rjxs%2BfO14G8EBHrLxYMxzNaPteF%2F4SMz%2FV8d5dimnjCRem3UVLPO1R9OUQgJPsBxAtcw%2B7Z%2BfP%2BTbmvVsQYOmcoB8Aj5%2Br5PDJDLRJhZ%2Fddcp4wOYdd"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6eddfe79ce0b3757-MXP

GET
H2 200 ad.gif
api-54-149-92-0.b2c.com/s/ 43 B
374 B 34ms
34ms Image
image/gif 2606:4700:20::681a:623
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://api-54-149-92-0.b2c.com/s/ad.gif
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:623 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:57 GMT
cf-cache-status: HIT
last-modified: Fri, 18 Feb 2022 18:21:27 GMT
server: cloudflare
age: 4932
etag: "620fe3a7-2b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TCxlc27KJnD%2FPDHxDd%2FxHdi0TAc%2BmVtwvaEka1j2rkYeY7ug8v3aWV8RdKzCGAA6Co0ouI33MpRJGsf4W0qlN7prWzdWjPb2MDqkExoBtGKdcSIoorZXcH6aD4EnDOPh6RrUNxwmi9uq2GY%2FJKxgCBz2rqzk"}],"group":"cf-nel","max_age":604800}
content-type: text/plain; charset=utf-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6eddfe7a4f1f3757-MXP
content-length: 43

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c72f57881ea9665da29cc614802f61a04084e06b14de9f1d79ce26273e66a991

Request headers

Referer
Origin: https://wheregoes.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H2 200 CEAIT5QE.json Show response
srv.buysellads.com/ads/ 934 B
669 B 303ms
97ms Fetch
application/json 143.198.21.127
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.buysellads.com/ads/CEAIT5QE.json?forcebanner=443784&ignoretargeting=yes
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.198.21.127 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-us-ny-24.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: abb1fa58e511b61d3d5af96347559b58b37011d5d4bf3f09854a17b6d28a4303

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: gzip
server: //srv.buysellads.com
content-length: 556
vary: Accept-Encoding
content-type: application/json; charset=utf-8

POST
H2 200 adreq Show response
ads.servenobid.com/ 98 B
429 B 115ms
33ms XHR
application/json 54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=1582
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 31a5f47b74e0c81c552515811984d877dbd8d8290cebae2d2e2e6f6609732c66

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 712 B
1 KB 148ms
108ms XHR
application/json 185.255.84.151
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&PublisherDomain=https%3A%2F%2Fwheregoes.com

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.151 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

f44c5166dbe233b16e8a1f1a10fc9a989f2773711b35fdd934187a72ba47c99f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:32:57 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-max-age: 3600
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 93
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 712
expires: 0

GET
H2 400 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
331 B 342ms
106ms XHR
text/html 3.214.91.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=0&buster=1647606778169&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&measurable=true&bids[0][bidId]=17365f7f87dd1c5&bids[0][config][property]=WhereGoes&bids[0][config][zone]=Wheregoes_S2S_Leaderboard_ATF_ROS&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=970&bids[0][sizes][1][height]=90&bids[1][bidId]=18103526a333d0f&bids[1][config][property]=WhereGoes&bids[1][config][zone]=Wheregoes_S2S_Sidebar_ROS_Pos1&bids[1][sizes][0][width]=300&bids[1][sizes][0][height]=250&bids[2][bidId]=19d4bb0de5a28fe&bids[2][config][property]=WhereGoes&bids[2][config][zone]=Wheregoes_S2S_Leaderboard_InContent_BTF_ROS&bids[2][sizes][0][width]=728&bids[2][sizes][0][height]=90&bids[2][sizes][1][width]=300&bids[2][sizes][1][height]=250&bids[2][sizes][2][width]=336&bids[2][sizes][2][height]=280&bids[3][bidId]=20d66c4a25c4062&bids[3][config][property]=WhereGoes&bids[3][config][zone]=Wheregoes_S2S_Sticky_Sidebar_ROS_Pos2&bids[3][sizes][0][width]=300&bids[3][sizes][0][height]=250&bids[3][sizes][1][width]=120&bids[3][sizes][1][height]=600&bids[3][sizes][2][width]=160&bids[3][sizes][2][height]=600&bids[3][sizes][3][width]=300&bids[3][sizes][3][height]=600&property=WhereGoes&foo
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.91.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-91-80.compute-1.amazonaws.com
Software: / Express
Resource Hash: 5352720a5ffb778e42dbb1d4b81c975c02018dd660e1fe9c430cbf13dba78762

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:32:58 GMT
x-powered-by: Express
etag: W/"38-oN4RNSEETikJBvZER0pAAAEOHrw"
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 313ms
77ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280a57d4001b&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: ddd645a7f4ec31094c51e98bf6236477fed568a904c35213364020b538c9fc4e

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 327ms
91ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 8c6b68d05c13b48eb24528baee8d040f5ad68bf68584452f456937fa7d441e21

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 333ms
97ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 078e34b81d0bc8d752acbb4106c6301e1190e564ed5d3bb7e8c4a40a19126676

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 360ms
124ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: b8bae0ce01d042b046cbff8dced1bc7509f37a026d65ddc2ef694840281f963c

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 358ms
123ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: e06c367ac13fd15ed662a1d5ef1868fd782619ecda694469b3a15f4fecc208bf

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 345ms
110ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a9691a0017c7c276934280be73c001e&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 91df2626946258ee2caa4bdd3473fa691e6d342db0b70e48a2c9fb787c714618

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 322ms
87ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 9b5de3e41aad6c2efcacf2a2d9793975d974f7923ac8e87db8f3af7574c6830a

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
290 B 307ms
73ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280c36f30017&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 7b9c7cd07ebf0219a3655d843333dd486eddf44a0fdb48804a91fc47eabf3d91

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 328ms
93ms XHR
application/json 52.28.203.152
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee280cdbc80018&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.28.203.152 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-203-152.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 4fc3e6c089a1c05a50eac4c7324c57579d0fface4a57b77939e1ab85c6a5e875

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 4 KB
3 KB 124ms
74ms XHR
application/json 2602:803:c004:200::141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=2&alt_size_ids=55&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=5683df04-2752-42af-b277-cb89b272d7f8&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5451061620234201
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: ece1eaa51ad5e70f65cafee92cbbccf46171686dd52cadf361906ad954077f56

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:58 GMT
Content-Encoding: gzip
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 1765
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 241 B
1 KB 107ms
57ms XHR
application/json 2602:803:c004:200::141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=65337886-465c-4651-87f9-2b88a2fe2f08&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7666310570647596
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 9874adbdc22a7d0d373d3296be014ecc4e60605000c39641cdb97caaafbe4704

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:58 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 241
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 126ms
75ms XHR
application/json 2602:803:c004:200::141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=2%2C16&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=419f1f0a-816d-4213-846b-a29b61686648&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7600695553086452
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b21d5958c49133a1bab4b721a942ff8a1d1e680ae1a203d2b30debc3093975d2

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:58 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 265 B
1 KB 142ms
91ms XHR
application/json 2602:803:c004:200::141
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=9%2C8%2C10&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=fb8ffecd-bbf3-44c5-ae4f-eb24739f5b22&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.5346009200613759
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 4c721944152f1d435e920122200c6e12debf353cb89da6bfc0110f682848f8fb

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:58 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 265
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 20 KB
12 KB 196ms
160ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

bidder.par.vip.prod.criteo.com

Software

nginx/1.17.9 /

Resource Hash

be3ac1a18c3e924b95e4fcb439b8d8a04037bf22a0736de4834421780e174129

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 18 Mar 2022 12:32:58 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 9c196b1f-63fd-4b8b-9e7c-d9dac62c1adb
Server: nginx/1.17.9
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 93 B
743 B 671ms
361ms XHR
application/json 63.251.14.14
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.43.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.14.14 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS
Software: /
Resource Hash: 955f9de7d8bf1a81c8268054dd02a8a2d79ffff56e2cf9d0a67f3b08fba64923

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 18 Mar 2022 12:32:58 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1sea1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 98

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
923 B 77ms
56ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: 72392b34d1ff1611eb16b7a57b3f4a4b0fa4a309a10cd0f6bbc5fe6cb9d2e28b

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
311 B 88ms
42ms XHR
application/json 178.250.0.165
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=52070966379

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.165 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 18 Mar 2022 12:32:57 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
360 B 27ms
8ms XHR
application/json 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://wheregoes.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H/1.1

200
OK

4 Show response
v4-api-54-149-92-0.b2c.com/api/
Redirect Chain

https://api-54-149-92-0.b2c.com/api/x?cgi1c6sfWSK3wLHx$dXJsJDAkaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjIxNDQyMTE2LyIsInJlZmVycmVyJDAkIiwiYW5jZXN0b3JPcmlnaW5zJDAkIiwidmlkZW8kMCQxNjAweDEyMDB4MjQiLC...
https://v4-api-54-149-92-0.b2c.com:444/api/4?cgi1c6sfWSK3wLHx

0
141 B

491ms
159ms

XHR
text/plain

54.149.92.0
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://v4-api-54-149-92-0.b2c.com:444/api/4?cgi1c6sfWSK3wLHx
Protocol: HTTP/1.1
Server: 54.149.92.0 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-149-92-0.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Connection: keep-alive
Transfer-Encoding: chunked
Access-Control-Allow-Methods: *

Redirect headers

date: Fri, 18 Mar 2022 12:32:58 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
location: https://v4-api-54-149-92-0.b2c.com:444/api/4?cgi1c6sfWSK3wLHx
access-control-allow-methods: *
content-type: text/html
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SZPJHDjq%2Bn3CgMwKfDg%2FFWpGxa1HRD0PdSTUFhw9vqT9pHJOCXn1v5wQT4JuqYHQoSHYsHFYhGxbST7lVuMNx8z8jZqGXp2tkYVb0bHfQ8WEZvOh%2B9owDwat6MAkopo%2BtoD1yTRHG%2FlpH6QgodIvdZLcDaju"}],"group":"cf-nel","max_age":604800}
cf-ray: 6eddfe7c1a4159bf-MXP

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 39ms
17ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 40ms
17ms Script
application/javascript 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 86 KB
15 KB 88ms
87ms XHR
text/plain 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=36213930197001&correlator=3653607714413334&eid=31065485&output=ldjh&gdfp_req=1&vrg=2022031401&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_ATF_ROS%2CWheregoes_S2S_Sidebar_ROS_Pos1%2CWheregoes_S2S_Leaderboard_InContent_BTF_ROS%2CWheregoes_S2S_Sticky_Sidebar_ROS_Pos2&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x90%7C970x90%2C300x250%2C320x50%7C728x90%7C300x250%7C336x280%2C300x250%7C120x600%7C160x600%7C300x600&fluid=0%2C0%2Cheight%2C0&ifi=1&adks=1696759606%2C2861055222%2C3878002045%2C3809685794&sfv=1-0-38&ecs=20220318&fsapi=false&prev_scp=optimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641228026595-4_123456%26optimize_inview%3Dfalse%26hb_size_rubicon%3D728x90%26hb_pb_rubicon%3D0.01%26hb_adid_rubicon%3D73c9651e03ca15d%26hb_bidder_rubicon%3Drubicon%26hb_size%3D728x90%26hb_pb%3D0.01%26hb_creative%3D1512%253A7515751%26hb_adid%3D73c9651e03ca15d%26hb_bidder%3Drubicon%26_bd%3Dbid%26_pl%3D0.01%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641228120494-5_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641318314037-7_123456%26optimize_inview%3Dfalse%7Coptimize_refresh_int%3D0%26optimize_ad_unit_id%3Dbsa-zone_1641318529900-6_123456%26optimize_inview%3Dfalse%26hb_size_appnexus%3D300x250%26hb_pb_appnexus%3D0.02%26hb_adid_appnexus%3D74a9710bcab212d%26hb_bidder_appnexus%3Dappnexus%26hb_size%3D300x250%26hb_pb%3D0.02%26hb_creative%3D77221793%26hb_adid%3D74a9710bcab212d%26hb_bidder%3Dappnexus%26_bd%3Dbid%26_pl%3D0.02&eri=1&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&sc=1&cookie_enabled=1&abxe=1&dt=1647606778869&lmt=1647606778&dlt=1647606777048&idt=698&biw=1600&bih=1200&adxs=209%2C1091%2C209%2C1091&adys=474%2C666%2C1751%2C950&oid=2&ucis=1%7C2%7C3%7C4&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1182x1794%7C300x1334%7C862x1402%7C300x1334&msz=1182x90%7C300x250%7C862x250%7C300x600&fws=516%2C0%2C0%2C0&ohw=1182%2C0%2C0%2C0&ga_vid=1800110877.1647606779&ga_sid=1647606779&ga_hid=927043316&ga_fc=false&btvi=0%7C0%7C1%7C0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a99416efd5b3d8e3f989832bb9bc9b08505dac1d13c4a4b333e1bbf8316fc712

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14728
x-xss-protection: 0
google-lineitem-id: 5651215826,5320060794,5320060794,5650535185
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138344350522,138305848162,138305489432,138344350525
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 53ms
32ms XHR
application/json 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022031401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

271f203a316350eebee2ef0cd3e314739cd645b3983fb32bce274e89b8f96a32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10585
x-xss-protection: 0

GET
H2 200 container.html Show response
dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9FFE 6 KB
4 KB 75ms
15ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Fri, 18 Mar 2022 12:32:58 GMT
expires: Sat, 18 Mar 2023 12:32:58 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 41ms
19ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:58 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 08BB 0
0 51ms
51ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssgwT0i3e6qQQlD5WdllwflOphOjv_bG5uDg3e7zI3dN3E6nl8or_R_taeLISPhk_aBZfs9KZO9ezWaWqPetS_nGNXFQsAoRQ10r3IHtgwgCf-_404Z-TiciE9qRaPacTW3imWO-gYWfBHOvN3ZApD16MwDkpuxJwrnwGuA06dQ6dK4Si-B82bDbI-TEhEdD_6bRYOfKo9uKpor2bxnT3y164cqbX8MKr7FnmEeMtTBDXkWSYrwfKcs2C88RZ8KdZkvhOTEcfS6LnDnSjglxPExLTJcFQngd_cAsa-sVySAqSFg5LF213anOHDnY0jkzOTpV4FDy121b-uqcQY&sai=AMfl-YQVE_Sc2gBRofy5UXFgqYRdPkVXFDC3KIBh9rEzatQ0vmT6E1jDknY1KmLFBfWzZM8jzoUHZcPQpGuRFMMO6F5zwA_vqiOW7VRE2bgu6Q5KiqwGoFmneq43chafG7k&sig=Cg0ArKJSzPluPuNCRKWiEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame 08BB 26 KB
9 KB 51ms
20ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
fastly-original-body-size: 8874
age: 10421
x-jsd-version: 1.13.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19178-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6eddfe80de7901e7-ZRH

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 08BB 117 KB
36 KB 93ms
77ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 200 container.html Show response
dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F9A0 6 KB
3 KB 24ms
9ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Mar 2022 12:32:58 GMT
expires: Sat, 18 Mar 2023 12:32:58 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 4973 6 KB
3 KB 22ms
10ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Mar 2022 12:32:58 GMT
expires: Sat, 18 Mar 2023 12:32:58 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
content-type: text/html
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 82A6 0
0 50ms
50ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsueMzM95bl-RY-mflv7Io65x7NL71RGhUaFCSyJoSKjAUxiiwMQ0czqz8QXaZhmA5aqqegxonrYzSmZsbD9SdlhnRLyGNeTnDucw5av9xcvfbm5dMeWM3Y_ezGi3SyRe8viuxlNHsAW1wlx37WJiQF79VxWSveFV7WcrnFTEoDcFZ1M7IwHBz7bfJdkfMShYpTcjKkV56vM2SeyJsKtufU2j6bl-ztJs5gMrFVKQpuOPENmpRsiU4wsqIcINyvlUkhYou2Pu0ED-g01bW5xCqacQSFGja8dtIDuO_M_iQH68nXpGGnOet3NGLqOUTO9K6XQnWs2S16Hx_zaFELCXtoZ&sai=AMfl-YSJXf55Pxw77fJMrNKMIP_pZih9xVtczaTtdMQChwH-iPw64EYOY9e07eAjVNhMyAAQr-s97-4ZHmB_7339CZOTdo9-A6igxGle7wcGKGGFcAN27N29ba89BqGFCjI&sig=Cg0ArKJSzAioFnME90WnEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H2 200 creative.js Show response
cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/ Frame 82A6 26 KB
9 KB 41ms
21ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e72a4d605e3d5af4047f1f34af4008981be221e0809e57805c6011c451f81c14

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
fastly-original-body-size: 8874
age: 10421
x-jsd-version: 1.13.0
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19178-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"682b-2ihEYwqesMldd0dS8BiHEV2ELiA"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6eddfe80de7a01e7-ZRH

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 82A6 117 KB
36 KB 94ms
88ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022031401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 7815 13 KB
5 KB 25ms
8ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 18 Mar 2022 12:30:27 GMT
expires: Sat, 18 Mar 2023 12:30:27 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 152
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame C0FE 783 B
1 KB 49ms
18ms Document
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

553207120139088453be941c741792065fb20051cb9191d23dfe7e5dcb2416e3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-ZRgvAitMj39weubAkhWemQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Fri, 18 Mar 2022 12:32:59 GMT
date: Fri, 18 Mar 2022 12:32:59 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-ZRgvAitMj39weubAkhWemQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame F9A0 22 KB
7 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 09:36:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10599
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 18 Mar 2023 09:36:20 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame F9A0 8 KB
4 KB 68ms
14ms Script
application/javascript 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=1331750998&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsvFtrC_Hs2QGTlNGJVcVPaviIsZ68sPLfzagLrWnu3k9fIbnubkzQRIcPlYMbbxaJifkhlKXpNfL80UfRei93VL-eUMbndkzSSwO6U2_ZKyqPqHRbG8HFyWURU6s79EgX9FEYvSPuVTl336A-2nxN1zK3H7i6iGtuchZW_EbqyJhxtnETTxV9QnlekfNTUQeqY00zrWH6Y6WoF3qXEAPp3v0vJLC8hx6F0eT9Hm3pKz4eMgJ6ekZMRtg39huwbEIhvVVx903TsBzNhUzmvu0F6VZbCpBjLQVhi_Rr-v_26CXnuXpGzlRjVk4eihkOu6_s4lbeRF%2526sai%253DAMfl-YTj_fvKADaUVe9UIPbk0cHKcpHEY3OYss0XKv_tFMC6CFmNN8aXQZFfQEQRn-nPkHHmiGY1Hwwz6gtXWclGB9qzCuCJ0hAAtfbCYNiV3CdjMfwKz3ehhyi0FQnIWKw%2526sig%253DCg0ArKJSzGeL1RN3piEOEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

fff8636c63bdf902ec1c87237222de4846eccfcbf1e142af7e1f616dc31e3328

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:32:59 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 19ce0e44-7b59-41aa-a553-555bf8d62158
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F9A0 117 KB
36 KB 65ms
63ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 4973 22 KB
7 KB 10ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 09:36:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10599
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 18 Mar 2023 09:36:20 GMT

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 4973 8 KB
4 KB 99ms
47ms Script
application/javascript 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?id=18678115&size=336x280&cb=1466629052&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsvUyf7_ICltzxeh9lOSHWAeyyl-wfnqmWHAZsiwGcp8GWBA01wp_2mVRqY8ku_Ad0lLsOu4KXycJVBIGlufFOd4FrIdf-ms0x1EDTjium344B2XolFlr_1SbonfZhxLKucKpNYPJf4TJBN62V2gq6WNPR0HlBNdf2drinTKsNtcZoV-h2R5WzUzKlnRZp4QzYrl7BkggAGmJfDI5uWKyXW_sO7uZQavHUy3Ffxs5kgcbvSP3jE9g0TQYm2UpKJTIRKxFjULCAb5dq0GOGuIpFB99h_gwdtNPwXrx4t2S8g6j6tQ1jeBKigDCUFVt76qSRGiUihLDVDHtYJFgloVak8gjA%2526sai%253DAMfl-YSQR8imuoM8DXb3QrYM6Jx_kPnMWntZYhulOjTDcTftfIiB-pe7EGVX_TMyriV-ZIO62pAKcJ36EwqI8oIBszQnRLxaXlFDcwpR8rY51N2xnDiw9WjN4FM90uyIpwg%2526sig%253DCg0ArKJSzCRtG2slBiu2EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

c373f23fd5aede7a7fbf9428955a2eaa2059fb92a0434c6c23a1ac89281deab1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:32:59 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: eca33408-3cbd-4c9d-963b-eead5fd33f07
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4973 117 KB
36 KB 62ms
58ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F9A0 0
0 52ms
52ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvZGzrmJIIVuoe15fbTYGa0VesBHGe2VNGql6NSzseNlw8iUI3hoZMNN3B--CDgp9gjABX8yQl76KwU-QgEWede33G7Zd3UeAUjJ7woKrzVKSKFsn1xh4gPXYmhMSUxtFUSebNqX19cUMnr6PR76d1WRjK4iuxiE5MOxGCrwxQmwQTdCEBtXxwC6J3IDyPyUx5CgGiEsWvOlXzF1jWdETsE9dTXdKc-Tdo5eeUUcY3-wNWmbiA9WTznNihn0e89lzpFSfzYg8wU3bVQKrb5NeByBg9n8-aQ5e-n-dSK4SwcMmNf3ZAPZB_z0KGkblyIM20A_Sn8BO9o&sai=AMfl-YQcXnQV5sXjcrY30822VcYvSjNNYoGQU0nZ_d_ynTFOWlrij6vKLTGxkGm-tTU16s8zMUnu4Q8hI2qD3KaJblLqSIRS5khOlh8Lb0VfHu9jPqOnY29BIZcKTywHMR0&sig=Cg0ArKJSzGuadISJ2Lm8EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4973 0
0 48ms
48ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu4Jc9huuldT2eLTgTtdmj5gUcYgKOK8jnKtgo75AhgKjZD1YMShVUWADX_D9QxCO66KhrtxAJwZuRBXU6UWigSfZ4rYbD7I2Pr7mH1wY_3XLbwe3pymjDIioaoyAtMYKFUbhFUFEyD1DntQqr0V8WRNJ1WGmKr755rcUZh2TITQsr7OYqIrxq-KLwhLqQCmU9IlxLOVjMrju0duC1hx0zL-PSEsm1q8Ww36tqGxcElm9IrwG_VPkPyYZ1N2_7xRwutTrXNQksnhvrQCJ38cKG4nrvMbOKGA29jiT03RlvN9fvQMC2LHX_F6bDC3t4kIGZyFrn_K-Z-qsHVepy3ne7TnZmRWA&sai=AMfl-YQ_ZxpNuxf2kC62qtdyOc6ylUEWi94f9kJGvO7OwpwnAyLmxXcZTBd0qv7RZgcjz-HIhHMJxe8z_emPeswQtZxd0S1Dc-gVgo9_a4y5O7ysePK4Qvx-VG_2KPQo4To&sig=Cg0ArKJSzCTBOwL-m0IrEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 3BB6 13 KB
5 KB 34ms
11ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4980
x-xss-protection: 0
date: Thu, 17 Mar 2022 19:52:10 GMT
expires: Fri, 18 Mar 2022 19:52:10 GMT
cache-control: public, max-age=86400
age: 60049
etag: 12223946614886178233
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 7E3D 12 KB
6 KB 31ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8996d7b9fba17a4ad4880bb154f6b56d33f9ff87ecf4f830bc0488cdc1616f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 11:50:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2553
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5307
x-xss-protection: 0
server: cafe
etag: 5818309846818389003
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 18 Mar 2022 12:50:26 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 7E3D 85 KB
29 KB 45ms
6ms Script
application/x-javascript 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:32:59 GMT
Content-Encoding: gzip
Age: 1913668
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29216
X-Served-By: cache-lga21944-LGA, cache-hhn4080-HHN
Access-Control-Allow-Origin: *, *
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
X-Timer: S1647606779.120376,VS0,VE0
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 24 Feb 2023 08:58:29 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 48360, 412036

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame 7E3D 0
813 B 66ms
33ms Image
text/html 185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%253A%252F%252Fwheregoes.com%252Ftrace%252F20221442116%252F&e=wqT_3QKGBugGAwAAAwDWAAUBCPr30ZEGEMqtnIGG1pagIRgAKjYJ1sVtNIC3oD8RVgkWhzO_mj8ZAAAAwB6F6z8hVg0SACkRJMAxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKGf6SRYmNVSYABoz_hreACAAQGKAQNVU0SSBQbwqpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjE0NDIxMTYvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYQEG9CoBX2I9QUtBbWYtQ0JocExYcFdMeWNuaktEeGdUY0IwNzZvR3N4Nm5QQW1JSXFfdGJ5UnNsNkxEdXMzY3VSVm9pWU1oU2JrYk9hMWw5ZlBJQWpMOTVNMnFlS0R5Mzd2X3NLci1palEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMjM5NjAxNDcxNTMzNTAyMjI4MiIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDDE5My4yNy4xNC4yNKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADaBAIIAeAEAfAEoZ_pJIgFAZgFAKAFkIzJoNjBx9cewAUAyQUAAAAAAADwP9IFCQkBCgEBcNgFAeAFAfAFzJAl-gUECAAQAJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHDwFYRBgAIAAwADi_BkAAyAcA0gcNCRFHAUUI2gcGCSVE4AcA6gcCCADwB-TCAYoIAhAA&s=72015a3ce06d6b9c7e545d8de8186f2caf5ea832

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:59 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e2fce4c4-7667-4f45-9e4e-42a9c78aa86a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7E3D 0
20 B 63ms
48ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-BPWI8lRJ_vNEHo8VO_mRPdF2MkQ3_ydzOw1FJ9syEDTQ1o7wU6b39HV0PCkELE6rA33sX8JA8Qf7t86bNrzzsdubkvqw

Requested by

Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/prebid-universal-creative@latest/dist/creative.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 799D 5 KB
2 KB 1027ms
530ms Script
application/x-javascript 103.229.206.241
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?exch=ruc&s_exch=ruc&id=5aW95q2jLzIzLyAvTldFd1ltTmpaalV0WkRJek15MDNNRE0wTFRBd01EQXRNREF3TURBd01EQXdNREF3LzE2NTQ4NjI4MzIxOTE3NjgyOTUvNzUxNTc1MS81NjM3MjU0LzkvdjA3RFh0LWxrYVM3UFZRVlotcElsaGpGUXh4TkZMWU5xbGhoLWtqdTk4Zy8xLzkvMC8wLzExODM0NzcvMC8yMzQ0OTUvNzQ2MzQ1LzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvMTY1NDg2MjgzMjE5MTc2ODI5NS96cmgvMC8yMDA1LzU2Lzk5OS8yLzIwMDE6YWM4OjIwOjMwMDo6LzAuMDAwLzE2NDc2MDY3NzgvMTY0NzYxMDM3OC85LzE4ODEyLw/alfT7BzP81UueHYxqtZUQ4PD7BA&nodeid=1612&group=zrh&auctionid=1654862832191768295&shardkey=1654862832191768295&sid=5637254&cid=7515751&bp=a_acjcch&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.133.235&3pck=https%3A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2Fc1d2fa44-701d-4e16-987e-cef10ffb94e7%2F
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.229.206.241 , Singapore, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.304.1 /
Resource Hash: 23a99bbf0ff57e79866d02eb0d7891075349dc8272e657cb20831dfccafd28f9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:32:59 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1647606778
Last-Modified: Fri, 18 Mar 2022 12:32:58 GMT
Server: MMBD/3.304.1
x-mm-latency: 285 (1)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: hkg-router-x61, zrh-bidder-x123
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Fri, 18 Mar 2022 12:32:58 GMT

GET
H/1.1 200 c1d2fa44-701d-4e16-987e-cef10ffb94e7
beacon-fra2.rubiconproject.com/beacon/d/ Frame 799D 43 B
354 B 89ms
9ms Image
image/avif 2602:803:c004:200::155
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://beacon-fra2.rubiconproject.com/beacon/d/c1d2fa44-701d-4e16-987e-cef10ffb94e7?oo=0&accountId=18812&siteId=405332&zoneId=2271886&sizeId=2&e=6A1E40E384DA563BCF1C271FFC7D700EEC0D63ACBE0B6B2BEE37727E9DBBB216A2E4B847527514436702D809C6B51188172DB22D3B21A9B53BDF152FEE3D8D5F703BA9390A10593DE12BB6BA04C926BCCD72F1487ABC57A3217ECA6452748A6E76B53118A402DEAE279E67E7054ED3DF97EB96A22C0B82AE21F3746B0B42ADFE14E1CF13EF6C13C10A41A1444F2386AEA1FC0345D7356879A826E37090A2C3893EF3C435DF00FD35AD0BB9868FEC88B50D61401B43F0A1C2

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_CBC

Server

2602:803:c004:200::155 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),

Reverse DNS

Software

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:58 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Content-Type: image/avif
Cache-Control: private, max-age=0, no-cache
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block
Expires: 01 Jan 1970 10:00:00 GMT

GET
H/1.1

200
OK

ck-confirm
tags.mathtag.com/ Frame 799D
Redirect Chain

https://tags.mathtag.com/notify/img?exch=ruc&s_exch=ruc&id=5aW95q2jLzIzLyAvTldFd1ltTmpaalV0WkRJek15MDNNRE0wTFRBd01EQXRNREF3TURBd01EQXdNREF3LzE2NTQ4NjI4MzIxOTE3NjgyOTUvNzUxNTc1MS81NjM3MjU0LzkvdjA3RF...
https://tags.mathtag.com/ck-confirm?bid_id=1654862832191768295&node_id=1612&exch_id=9

49 B
330 B

732ms
527ms

Image
image/gif

103.229.206.241
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=1654862832191768295&node_id=1612&exch_id=9
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: HTTP/1.1
Server: 103.229.206.241 , Singapore, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.304.1 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:01 GMT
Server: MMBD/3.304.1
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: hkg-router-x54, zrh-bidder-x123
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Fri, 18 Mar 2022 12:33:00 GMT

Redirect headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
x-mm-bid-request-time: 1647606778
Last-Modified: Fri, 18 Mar 2022 12:32:58 GMT
Server: MMBD/3.304.1
x-mm-latency: 569 (0)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location: https://tags.mathtag.com/ck-confirm?bid_id=1654862832191768295&node_id=1612&exch_id=9
x-mm-dbg: Count
Cache-Control: no-cache
x-mm-host: hkg-router-x19, zrh-bidder-x123
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Keep-Alive: timeout=360
Content-Length: 85
Expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 200 Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js Show response
pagead2.googlesyndication.com/bg/ Frame 7815 35 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1aea2369edc419847873c9ce637400269e8dfc7c8c637a8c0bc20c63f977bcbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 22:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 310655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13802
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 22:15:24 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame F9A0 51 B
377 B 56ms
17ms Script
text/javascript 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=300x250&cb=1331750998&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsvFtrC_Hs2QGTlNGJVcVPaviIsZ68sPLfzagLrWnu3k9fIbnubkzQRIcPlYMbbxaJifkhlKXpNfL80UfRei93VL-eUMbndkzSSwO6U2_ZKyqPqHRbG8HFyWURU6s79EgX9FEYvSPuVTl336A-2nxN1zK3H7i6iGtuchZW_EbqyJhxtnETTxV9QnlekfNTUQeqY00zrWH6Y6WoF3qXEAPp3v0vJLC8hx6F0eT9Hm3pKz4eMgJ6ekZMRtg39huwbEIhvVVx903TsBzNhUzmvu0F6VZbCpBjLQVhi_Rr-v_26CXnuXpGzlRjVk4eihkOu6_s4lbeRF%2526sai%253DAMfl-YTj_fvKADaUVe9UIPbk0cHKcpHEY3OYss0XKv_tFMC6CFmNN8aXQZFfQEQRn-nPkHHmiGY1Hwwz6gtXWclGB9qzCuCJ0hAAtfbCYNiV3CdjMfwKz3ehhyi0FQnIWKw%2526sig%253DCg0ArKJSzGeL1RN3piEOEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:58 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 3370
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame F9A0 9 KB
7 KB 228ms
227ms Script
application/javascript 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1647606779&bdh=XDzTefPVKAqSmnRhcHg3rAjZcj4.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fdcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1331750998&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsvFtrC_Hs2QGTlNGJVcVPaviIsZ68sPLfzagLrWnu3k9fIbnubkzQRIcPlYMbbxaJifkhlKXpNfL80UfRei93VL-eUMbndkzSSwO6U2_ZKyqPqHRbG8HFyWURU6s79EgX9FEYvSPuVTl336A-2nxN1zK3H7i6iGtuchZW_EbqyJhxtnETTxV9QnlekfNTUQeqY00zrWH6Y6WoF3qXEAPp3v0vJLC8hx6F0eT9Hm3pKz4eMgJ6ekZMRtg39huwbEIhvVVx903TsBzNhUzmvu0F6VZbCpBjLQVhi_Rr-v_26CXnuXpGzlRjVk4eihkOu6_s4lbeRF%2526sai%253DAMfl-YTj_fvKADaUVe9UIPbk0cHKcpHEY3OYss0XKv_tFMC6CFmNN8aXQZFfQEQRn-nPkHHmiGY1Hwwz6gtXWclGB9qzCuCJ0hAAtfbCYNiV3CdjMfwKz3ehhyi0FQnIWKw%2526sig%253DCg0ArKJSzGeL1RN3piEOEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e074b189eced25c860366241bc3411be84afd218b99239d0cd3bb64186cef342

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:32:59 GMT
Content-Encoding: gzip
X-Creative-ID: 77221793
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 26473793-83ab-4f92-8360-9ad86b7b8e74
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 08BB 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 69eac294662cbd34c9ae7e3ea8a250e2711e3b9f3aa0abb213ce6610cd45c126

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame C0FE 0
0 81ms
79ms Image
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022031401&jk=36213930197001&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 82A6 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f460bfa82d57cc58250d036aeeffd2fb96e202cb282a645f6e981acbb12b5629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7E3D 78 KB
29 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8da664ba8dbaf4d8c3308d2d6953ed419107e8e8e7203ec3c911ff645092a84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29949
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431478962109"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H/1.1 200
OK rd_log Show response
ams1-ib.adnxs.com/ Frame 7E3D 0
813 B 35ms
34ms Script
text/html 185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/rd_log?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&e=wqT_3QLwLOhwFgAAAwDWAAUBCPr30ZEGEMqtnIGG1pagIRgAKjYJ1sVtNIC3oD8RVgkWhzO_mj8ZAAAAwB6F6z8hVg0SACkRJMAxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKGf6SRYmNVSYABoz_hreACAAQGKAQNVU0SSBQb0mwGYAawCoAH6AagBAbABALgBAcABBcgBAtABANgBAOABAPABANgCAOACn_A_6gIoaHR0cHM6Ly93aGVyZWdvZXMuY29tL3RyYWNlLzIwMjIxNDQyMTE2L_ICDQoGSEVJR0hUEgMyNTDyAgwKBVdJRFRIEgMzMDDyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhgKCklGUkFNRV9LRVkSCjE3OTAwNzk3ODLyAp0QCgtQUkVfU0NSSVBUUxKNEDxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjsvKgoKIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCmZ1bmN0aW9uIGsoYil7a1siICJdKGIpO3JldHVybiBifWtbIiAiXT1mdW5jdGlvAcQEfTsR0WwgbCgpe3ZhciBiPWRvY3VtZW50LmN1cnJlbnRTBfzwQDtyZXR1cm4oYj12b2lkIDA9PT1iP251bGw6YikmJiI3NyI9PT1iLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2I6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRBBdJyl9OwGHLG49UmVnRXhwKCJeaEEX8EM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0aW9uIHAoKQ3gAGgFYQxjPVtdBQkEZT0Bxgg7ZG8FHxhhPWI7dHJ5BQwsZDtpZihkPSEhYSYmASRQIT1hLmxvY2F0aW9uLmhyZWYpYjp7AS2QayhhLmZvbyk7ZD0hMDticmVhayBifWNhdGNoKG0pe31kPSExfQHWCGc9ZBkXAGcBFgxpZihnKXkAZj5eABA7ZT1hLjE2BCYmGQwoLnJlZmVycmVyfHwBlyR9ZWxzZSBmPWUsDctMYy5wdXNoKG5ldyBxKGZ8fCIiKSkF1RRiPWEucGEh1BmGAGIF__BAfX13aGlsZShiJiZhIT1iKTthPTA7Zm9yKGI9Yy5sZW5ndGgtMTthPD1iOysrYSljW2FdLmRlcHRoPWItYTthPWghKzkeAa41KjhhbmNlc3Rvck9yaWdpbnNuHAANawA9HXUAKQmGDDE7YjwRikw7KytiKWY9Y1tiXSxmLnVybHx8KAUILkIBOnYAFFtiLQoxXSEMGCxmLmg9ITAB4ykiAGgZqyHVFCwhMSk7ZiUWJQIEZT0yBAEgMDw9ZTstLWUpIbpEPWNbZV0sIWYmJm4udGVzdChnAY8gKSYmKGY9ZyksBQ4oJiYhZy5oKXthPWdJGwB9DV0AZRXmBCYmAcwBOwQ7MEFlAGQhWggmJmUFSAEbCCk7YwWtFHIoYSxmKW2LGCBjLmc_Yy4FZQw6Yy5pAUAAfXXQMHIoYixjKXt0aGlzLmlB1QEJCGc9YxkiAHEdIgh1cmwRJBRoPSEhYzsFLwWIJQqdKQB0lSl8cCgpLGM9Yi5pbmRleE9mKCI_Iik7c2V0VGltZW91dCgRjA0xAGWZOhhlPy4wMTplQTVEIShNYXRoLnJhbmRvbSgpPmUpaQ8MYT1sKCGkACJl_zQ6Ly8iKyhhJiYidHJ1ZYFrBGEuUmsEaC1yY2QiKT8icGFnZWFkMi5nb29nbGVzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZD0oZAGxDCkmJmRamQANMTAiKXx8InVua25vd24iYeNcK2QrIiZzYW1wbGU9IitlO2E9d2luZG93IR00ZD1hLm5hdmlnYXRvcikyDgBQLnVzZXJBZ2VudCxkPS9DaHJvbWUvSYUgZCkmJiEvRWRnGREcPyEwOiExO2RhfRVRLC5zZW5kQmVhY29uPx1oHRcYKGUpOgooYS1GQF9pbWFnZV9yZXF1ZXN0c3x8XhoAED1bXSksAa6RvgQsZDn8BGQ_ERY8OmQsZD1kLmNyZWF0ZUVsZcF1PCgiaW1nIiksZC5zcmM9ZSxafACJ4hhkKSl9fSwwdRFcMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9KVEQLnJmbD1dlMnR8EwgZW5jb2RlVVJJQ29tcG9uZW50KHQoKSl9O30pLmNhbGwodGhpcyk7Cjwvc2NyaXB0PvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSHDDHBvc2nBImQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgAftV-EmFSsoCQacNHi6jAhRhd2JpZCYFBvB5X2I9QUtBbWYtQlBXSThsUkpfdk5FSG84Vk9fbVJQZEYyTWtRM195ZHpPdzFGSjlzeUVEVFExbzd3VTZiMzlIVjBQQ2tFTEU2ckEzM3NYOEpBOFFmN3Q4NmJOcnp6c2R1Ymt2cXciIGJvcmRlcj0wIHdpZHRoPTEgaGUOEwkkPTEgYWx0PSIiIC0aqGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKaAQoMUE9TVF9TQ1JJUFRTEokBPHMScwg2CAEAZ2XKUGFkcy5nLmRvdWJsZWNsaWNrLm5ldDEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMAPp2VICB7cjNweCgnMSL7CRwnKTt9KSgpOz3rEOcTChBIAZ40UE9SVF9QQVJBTVMS0hORlYqVAPB9YWRmZXRjaD9hZGs9MjkzODI2MDU0MiZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9MzAweDI1MF9hcyZpcD0xOTMuMjcuMTQuMjQmb3V0cHV0PWh0bWwmdW52aWV3ZWRfcG9zRYsgX3N0YXJ0PTEmoecRuwB3emYLECZzdWJfDZgAYkGf8H1yLTMwNTY0NDcmaGw9ZGUmYWNlaWQ9TUFrYnRBQ0ZHN1FBLVZVMEFRNW9OQUdCY0RRQlVYSTBBYWh5TkFISWNqUUJrWE0wQVZaME5BR0dkRFFCajNRMEFjTjBOQUhpZERRQjczUTBBUkYxTkFFV2RUUUJLSFUwQVR0MU5BRkYBECxSblUwQVV0MU5BRk0BEABVARAEVmwBEABjARAYYlhVMEFXNQEQADcBECxmSFUwQVg5MU5BR0UBEABpASAEWXABEABaARAAcAEg8EZVdHpRUUZUYzBFQllCeGNBa01kWEFMNUhWd0NGeDVjQWhzZVhBS0Etb2dDZUVDcUF1cEJxZ0luUXFvQ0tFS3FBaXRDcWdLMgEQ9FsCb1dDcUFzNXJxZ0tQazZvQ3VaV3FBb0NicWdLQm02b0NncHVxQXFLb3FnSXNyS29DZmEtcUFyaXdxZ0lqdEtvQ3U4R3FBaExIcWdJenlxb0NKc3lxQW9iTnFnTEx6YW9DbXRHcUFzYlJxZ0o0MXFvQzI5YXFBa3pYcWdMajE2b0NROWlxQXFyWnFnSk4zS29DZk4ycUFwcmdxZ0o3NGFvQ3dPT3FBcF9scWdMcDVxb0NyLWlxQXR6b3FnSzE2YW9DdWVtcUF2cnBxZ0otNnFvQzZlcXFBal9ycWdKTDY2b0NOLXlxQXFUc3FnSXo3YW9DLXUycUFycnZxZ0xtOEtvQ01fS3FBcm55cWdJVDg2b0NZZk9xQXNQenFnS005S29Db1BTcUFyajFxZ0wwOWFvQ2h2YXFBc18ycWdLMDk2b0N5dmVxQWpuNHFnSnUtS29DdmZpcUFzRDVxZ0lsLXFvQ05mcXFBbHY2cWdMRS1xb0M1dnFxQWlYN3FnSkMtNm9DQ1B5cUFqXzhxZ0thX0tvQy1QeXFBbUg5cWdJRF9xb0NKdjZxQW5ELXFnS0NfcW9DOVhRa0JHS3p4UVd0em1VT2dHekxEb1doTlJFNFJ1SVNWOHI3RWdEcC14SkI3ZnNTYS0zN0VyWHUteExHN19zU0pQRDdFanp3LXhJNjhmc1N6UEg3RXI3eS14SVo5UHNTc3ZUN0VyUDAteEx1OVBzU19fVDdFaXYxLXhKQzlmc1NNdmI3RWx1ZjZoUmdvdW9Vbk1zY0dGelRsaG4zVm1zYWY4dTFMZyZleGs9MZWlACap2wBjrdvwsENHMWNhZkl1bkJ1aE1lbk4zTkJhTkdVY1UtSnlBQU5NaWNNWHpaMHU3c29IVHo0X0FBSzYzVWZxb0JsenNPSDIxMDBXcXMwci1KNWtuMWQ4di13RndNalJqZFNMV093aGNMT0JBcjlrVy1JRmpGc1RsRGhWNGdXS0ZkQTgxNUJ6QzNTNkVBTk5uUXBHVGRqZTRqNmhwS093YURGejJ1RERoN0U1aGI3eXo1TWNSdDRsTQ3AAGQRwPTKBWR3NU92bjlXUHFKRUJFSWNpc3M2cjJ1V0RzUldHdVRZWVN4VGtfMEdpVTNfU3N4RF8zSElzU3pJNGducWItOTl4XzRvclZjWUZGTTY1amZGYXFuTmVxUHBHMmE1QmpmdXpJeEpRcUdZOWQ0WnJCcl9ncDlDVlVfSjBDOGtZNnZnNzVqV3BnWGhtZ0tNQ0lQb3ktYm1GcTdISVduZU45bkxIWUJCOUdTYnpubFlyaU1NZk5rRVVzVkpRUmsyeEEyZjlVVTdSUmlfODIwOGpZU18xMkN3cDY3V1k5YTJxSFJaR1BGUEVJeWFPeEdnVjA5dloxclVkVmptNi1nWTdYenBwYXJyemNTTEpfVGVuOC1lZko0NXN3MGZsTUtVMDhaa1k1T0o4dk92UFpSQWlkdzVOUE84TmxXMDJXZ0dtckNIODljM0U5aHl1ajJwMEpWZTFnXzVOR3NleWpjU3U3eG1aZmI2VXRhUWt1OEk3YmVsMjJORU44OXlVMHBSdENGcS1GUkNtNnB6NTZxVjdXUVJEdkJPNDlTS3JnRl9SbHZJeW1OREphQ0c0cGtzakNUQUxNNzNqR1c2NlV2TkFsMlM1ZFdWaVFYNjFjRlRIc3FZLUF3V09aY1ltVDdzNnVVVjdFUDlYVlRUa1NhSURHNXFhNWlRT2I4ejgtQUFYNEE4WEEwUU0tTEZfVWxVUkFqNzFNRVRBUG9IcjVnb21UQU5mX18yTFJWbUNzT1Q2MFZLYjdXT0NUTmhUcEJnelpjQnRlLWxfYzlTQUFCMHB5VjFFWWszaUJtWTNkN1Jfam9ITWNlcnd1WnYzcWZPaUxaaHZyZ1NrNjM1NHMwZzN4SE45TVg4NGs1NVJhUzBYUGFIbTBnVmpHU25GZjk4TVZkcDVwMnRXaFUtT3g0a3ZRa1FJbk14b2dlekdRWktlekdwODNsN3BKTWZabUtac3Ezaks5NFNXN01ueTZ2Z0NNdEdZLWtJUlZXeThldjQyYVJTVnlIMFJFZWU4QjExWG1JSVk3MFZidHdxU1o0SElIZU5qSndEeno2OG1PZUtveVhjakFCTG9CZFB5NkdCTXl0elRzaXNYbUdNMHRJZVVpNFotR05WYlFzcDRneVJoUEZwSGRzSXBEenNnQmV4cEhMcEhzVGZacWxweW1hUDhtbEIyVHgzdWM1ZTZmLXB4XzBqLWxrbUN0VjVMaG5YVENQRXYyWWt0c2FmdnVJYmFON0lrWHdYajl1cE81T2xwUHE5THctLVNIeTN2SDRzRk50Vi00NXczT2czZ2FkS29aX1I4VUhNSWx2TVlZdTdyTEJrS1NMZWJOdVdRd05XeTV5dnc2eEVMQmFzazFDeUh3WXA3QWFCdWNfM1VMRW01WC1tMGRDZi1DUHcyRUhneFlIbkpfWkF0WF83Wmg3YWI1Q0JONmhYc1hKb21nc09wbTZjeUtFMEQ5WFc5cFBHd0pPTDZEcktTSi1BVndaT1NZQTJWR0pYN2JOYXlYRlNLRGFFJmNpZD1DQUFTQk9Sb1B1YyZhX2NpZD2AAwCIAwGQAwCYAxegAwGqAwDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDDE5My4yNy4xNC4yNKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADaBAIIAeAEAfAEoZ_pJIgFAZgFAKAFkIzJoNjBx9cewAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFzJAl-gUECAAQAJAGAJgGALgGAMEGAAAAAAAA8D_QBu6PAdoGFgoQAAAAAAAAAAAAAAAAAAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHDwgAEAAYACAAMAA4vwZAAMgHANIHDQkAAAAAAAAAABAAGADaBwYIABAAGADgBwDqBwIIAPAH5MIBiggCEAA.&s=d2dfca910764ddcc1b3bc17ca1c9e44ad9115d90&bdref=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&bdtop=true&bdifs=2&bstk=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F,https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:59 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9dbb9768-1dcf-4d4d-aab0-d2dda7fa745b
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 sync Show response
gum.criteo.com/ Frame 4973 51 B
376 B 19ms
18ms Script
text/javascript 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=336x280&cb=1466629052&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsvUyf7_ICltzxeh9lOSHWAeyyl-wfnqmWHAZsiwGcp8GWBA01wp_2mVRqY8ku_Ad0lLsOu4KXycJVBIGlufFOd4FrIdf-ms0x1EDTjium344B2XolFlr_1SbonfZhxLKucKpNYPJf4TJBN62V2gq6WNPR0HlBNdf2drinTKsNtcZoV-h2R5WzUzKlnRZp4QzYrl7BkggAGmJfDI5uWKyXW_sO7uZQavHUy3Ffxs5kgcbvSP3jE9g0TQYm2UpKJTIRKxFjULCAb5dq0GOGuIpFB99h_gwdtNPwXrx4t2S8g6j6tQ1jeBKigDCUFVt76qSRGiUihLDVDHtYJFgloVak8gjA%2526sai%253DAMfl-YSQR8imuoM8DXb3QrYM6Jx_kPnMWntZYhulOjTDcTftfIiB-pe7EGVX_TMyriV-ZIO62pAKcJ36EwqI8oIBszQnRLxaXlFDcwpR8rY51N2xnDiw9WjN4FM90uyIpwg%2526sig%253DCg0ArKJSzCRtG2slBiu2EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 4114
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 4973 0
813 B 14ms
14ms Script
text/html 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1647606779&bdh=XDzTefPVKAqSmnRhcHg3rAjZcj4.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fdcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=336x280&cb=1466629052&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsvUyf7_ICltzxeh9lOSHWAeyyl-wfnqmWHAZsiwGcp8GWBA01wp_2mVRqY8ku_Ad0lLsOu4KXycJVBIGlufFOd4FrIdf-ms0x1EDTjium344B2XolFlr_1SbonfZhxLKucKpNYPJf4TJBN62V2gq6WNPR0HlBNdf2drinTKsNtcZoV-h2R5WzUzKlnRZp4QzYrl7BkggAGmJfDI5uWKyXW_sO7uZQavHUy3Ffxs5kgcbvSP3jE9g0TQYm2UpKJTIRKxFjULCAb5dq0GOGuIpFB99h_gwdtNPwXrx4t2S8g6j6tQ1jeBKigDCUFVt76qSRGiUihLDVDHtYJFgloVak8gjA%2526sai%253DAMfl-YSQR8imuoM8DXb3QrYM6Jx_kPnMWntZYhulOjTDcTftfIiB-pe7EGVX_TMyriV-ZIO62pAKcJ36EwqI8oIBszQnRLxaXlFDcwpR8rY51N2xnDiw9WjN4FM90uyIpwg%2526sig%253DCg0ArKJSzCRtG2slBiu2EAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:59 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 1c71e8e7-f8cb-41ed-8491-a4e97ea94ef3
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 3BB6 98 KB
35 KB 98ms
81ms XHR
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f5f1c0d33e58b6dad3e253ecf9a55107b262945551f017950539df4e21b50c2c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35445
x-xss-protection: 0

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 7E3D 0
833 B 20ms
20ms Ping
text/html 185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&e=wqT_3QKGBugGAwAAAwDWAAUBCPr30ZEGEMqtnIGG1pagIRgAKjYJ1sVtNIC3oD8RVgkWhzO_mj8ZAAAAwB6F6z8hVg0SACkRJMAxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKGf6SRYmNVSYABoz_hreACAAQGKAQNVU0SSBQbwqpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjE0NDIxMTYvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYQEG9CoBX2I9QUtBbWYtQ0JocExYcFdMeWNuaktEeGdUY0IwNzZvR3N4Nm5QQW1JSXFfdGJ5UnNsNkxEdXMzY3VSVm9pWU1oU2JrYk9hMWw5ZlBJQWpMOTVNMnFlS0R5Mzd2X3NLci1palEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMjM5NjAxNDcxNTMzNTAyMjI4MiIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDDE5My4yNy4xNC4yNKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADaBAIIAeAEAfAEoZ_pJIgFAZgFAKAFkIzJoNjBx9cewAUAyQUAAAAAAADwP9IFCQkBCgEBcNgFAeAFAfAFzJAl-gUECAAQAJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHDwFYRBgAIAAwADi_BkAAyAcA0gcNCRFHAUUI2gcGCSVE4AcA6gcCCADwB-TCAYoIAhAA&s=72015a3ce06d6b9c7e545d8de8186f2caf5ea832&type=nv&nvt=5&jm=1003&px=1091&py=950&bw=300&bh=250&sid=2073501811706311074&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&sw=1600&sh=1200&pw=1600&ph=2639&ww=1600&wh=1200&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:59 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 678fe103-d320-47c6-99fd-3047e2a89ba3
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 82A6 0
0 106ms
88ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssgDm5bUUArOKvFLuf6KUE1LI3QsobLGaa-bQ8DIqMdch-J-wxTj3ZW9lE3Fcigqe2hJqrXqhMi14lb9M4bei1zPShCfHJ-twKm5_vmX_j8m1KInkKoV-0dwanTCpcoUuI4Yj9AjenmD-g4Iqz7ldF6f4mBh51q9sidvOCT6jHdFM9SPJLZaNc4nsNKPCiGeYksert_1jzYLhlOMnhzsJiWy4Ag6_fsijQE6GPDCjHha6b4GyiYb_ucLPPUnPArj6vw5mmiozaLZDBjjSDM3cnPa3--QICETnZSmYvyARtNH8mXNtelTQwULyNHVOmvSSItJ2hjp3XcLiQ1r0c74iSHgKs&sai=AMfl-YS619clUuUTTDylE5TDdv7JcYLszi8wJ8ICLO46BwdqFRUf4T6X5QqFbyWyCScupYw1O42gMsW3PZ9GBXUZesWcPH0EL_jxEVKsO5ckl0Vr1k8KO9nhuZrSkzpDd54&sig=Cg0ArKJSzF511MZbh9EUEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
DATA 200
OK truncated
/ Frame 4973 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f032991f478bea7b9fe806d99f19b21d6d564280fbc1f55ab3a7b30af91e87d4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 4973 0
0 64ms
56ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvPH9q4bsSdtNzKcF6GXDSO5HEo350ob4Rd2f_8DEe3RK2JDsXNzdbJ4pkSaEeRoEIirLQAc1qB9tJgieEO-9Alq2Qb0okVnL36pP964o9BUwMPjXLfmVCD0v9r_O_f46LouQtSjo01PtoaR2tdSznVoIWfmMaYIxsciPwZ4nK8roM6Fo4joRzqW2cBxeJcO_77-NHfTgZyWHUquslsRkiccleMDEKqGZDZ--icQqc1eNptqZCLmQk_L2hmj-1wwXDWCCY3els6XhKE_b_d_SHJQuKEfM1OW2ffDAyS1xV5byZjvR76ZgQcJY45x2Dse0B4kImFnlqbDcklDXjmWhc8I-pN7bAA&sai=AMfl-YQYIfLoHl0dOzfSt6R9dq_XnsUEiUd98ie0SDXQ5s6KpkwQkkC2rZPEXqSh8UALs17X6b4W3ucwYRi5C8GN3PQ2Xr5fo4l69CQGRpABhnGPVNco2SpSZp6wNw5NcjM&sig=Cg0ArKJSzDOHb04vr5bfEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 7815 0
9 B 7ms
6ms Image
text/plain 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?gTy3FA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 0f18de3382609dbbdf7040d2a09cbeb9.js Show response
www.gstatic.com/mysidia/ Frame 3BB6 14 KB
6 KB 35ms
9ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/0f18de3382609dbbdf7040d2a09cbeb9.js?tag=client_fast_engine

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75b47e41e46797cb25fe5aedcbda3eb7d1cb3016cdee7abae11b650541f52ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 14:38:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 338051
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5525
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 23:17:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 12 Jun 2022 14:38:48 GMT

GET
H2 200 065117f8b414baf4aa31bbe217e75b95.js Show response
www.gstatic.com/mysidia/ Frame 3BB6 11 KB
5 KB 35ms
9ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/065117f8b414baf4aa31bbe217e75b95.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b13af406471d41b01dbf0740aa5912bc66663355cfcc207f406c53d05de28c0b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 00:01:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 131490
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4568
x-xss-protection: 0
last-modified: Thu, 10 Mar 2022 07:09:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Wed, 15 Jun 2022 00:01:29 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 3BB6 8 KB
1 KB 42ms
17ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

1e046a89bb90f44dadb24f5fdfbe412b5f6d320b790f7317fad956b193234726

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 18 Mar 2022 11:25:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 18 Mar 2022 12:32:59 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame 3BB6 2 KB
1012 B 7ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

647367edb473a569f80c0fb035ec50908b0b37e995c63663c02552079b974e76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:14:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1129
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 985
x-xss-protection: 0
server: cafe
etag: 15191321979658692665
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 12:14:10 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/ Frame 3BB6 25 KB
9 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a18b0faf6a447454e134730303202f8416b72f1d4f744b1d3b4646636240eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:31:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9657
x-xss-protection: 0
server: cafe
etag: 16576748017229546422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 12:31:30 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame 3BB6 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd54241a6ef534d4fd55a95d52035292958c4a55c350f8bb38b396ef4f49c1e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:28:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 279
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1235
x-xss-protection: 0
server: cafe
etag: 218260476562286327
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 12:28:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3BB6 117 KB
36 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame 3BB6 18 KB
7 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

358cfc8eb339a8ee01040ab6926f11d3c8dd16f43a93764639e7e89f5a1923f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:30:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7502
x-xss-protection: 0
server: cafe
etag: 16841233975859622389
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 12:30:50 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3BB6 0
0 35ms
14ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT8TOsFYRmjZlkvUQnLTuPrhyYJ-KQNG7f5bBj9p7Bf06onY9lZxtxjWlq5KLxCp4n6738L7Uqw_pp-64CLd8RUGr4XfQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 200 4d27fcb53540eb84a07f40e76e099f07.js Show response
www.gstatic.com/mysidia/ Frame 3BB6 38 KB
15 KB 29ms
6ms Script
text/javascript 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/4d27fcb53540eb84a07f40e76e099f07.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86ad3d1966fff4b0f6edd43b833c62ff9433b9d0cd5e87f6b09cc9e8164398d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 10:54:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 265135
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14630
x-xss-protection: 0
last-modified: Thu, 10 Mar 2022 07:09:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 13 Jun 2022 10:54:04 GMT

GET
H/1.1 200
OK script.js Show response
acdn.adnxs-simple.com/strikeforce/ Frame F9A0 112 KB
39 KB 37ms
7ms Script
application/javascript 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1647606779&bdh=XDzTefPVKAqSmnRhcHg3rAjZcj4.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2Fdcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=300x250&cb=1331750998&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsvFtrC_Hs2QGTlNGJVcVPaviIsZ68sPLfzagLrWnu3k9fIbnubkzQRIcPlYMbbxaJifkhlKXpNfL80UfRei93VL-eUMbndkzSSwO6U2_ZKyqPqHRbG8HFyWURU6s79EgX9FEYvSPuVTl336A-2nxN1zK3H7i6iGtuchZW_EbqyJhxtnETTxV9QnlekfNTUQeqY00zrWH6Y6WoF3qXEAPp3v0vJLC8hx6F0eT9Hm3pKz4eMgJ6ekZMRtg39huwbEIhvVVx903TsBzNhUzmvu0F6VZbCpBjLQVhi_Rr-v_26CXnuXpGzlRjVk4eihkOu6_s4lbeRF%2526sai%253DAMfl-YTj_fvKADaUVe9UIPbk0cHKcpHEY3OYss0XKv_tFMC6CFmNN8aXQZFfQEQRn-nPkHHmiGY1Hwwz6gtXWclGB9qzCuCJ0hAAtfbCYNiV3CdjMfwKz3ehhyi0FQnIWKw%2526sig%253DCg0ArKJSzGeL1RN3piEOEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 158ea3f9e71cc4bfeef3e274fc9ab9d29a2d1d24cdb94b5ee86664eef4cabf29

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:32:59 GMT
Content-Encoding: gzip
Age: 24833
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 39847
X-Served-By: cache-lga21924-LGA, cache-hhn4074-HHN
Access-Control-Allow-Origin: *
Last-Modified: Wed, 19 Jan 2022 12:36:35 GMT
Server: nginx/1.18.0 (Ubuntu)
X-Timer: S1647606779.364320,VS0,VE0
ETag: W/"61e805d3-1c12c"
Vary: Accept-Encoding
Content-Type: application/javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Thu, 17 Mar 2022 05:39:03 GMT
Cache-Control: max-age=86402
Accept-Ranges: bytes
X-Cache-Hits: 1, 29678

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 3BB6 0
17 B 60ms
59ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CkJjk-ns0YsbgEZn8gQe1zrT4D77m2ZFo78SHi-8OnbL0j4cdEAEg5pfWJWCV-qiCsAegAfD27pEDyAEBqQJ6pEUMppWyPqgDAcgDywSqBM8BT9CSarivDpdZP2Jyyzkp4BIQCo5agc-929yA4q9Fq096CVWJIcnxIckQqAxOLQ1z9Od7lzj8JUpKEgTkhhTNAMQUQwHaBQO--EDzLcsSSnK6XO_YsIVcJbMNFx4iyZFI0rV6LwM3qgtflkZO1jhjM0dDlLPWZGjLnWccroz-scvGZ7BcAlubJLI0MbTyQJUIXS5Pr5X1nMu2kkZcU4G2Fbos3qQy9m3wrvqsbImX5-92V5vmHicvO2rzcswmnrXvK28DPKvSnRQiznGAlBJ4wATc7Ni7iwOSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAYAH-IiRbqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB0ggHCIBhEAEYAPIIDmJpZGRlci0zMDU2NDQ3gAoEyAsB2BMMiBQM0BUBgBcBshcICgYIABIAGAA&sigh=SlUOl-81f9M&uach_m=[UACH]&pr=10:0.03265&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 18 Mar 2022 12:32:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3BB6 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d9dd6c184a28dd7911da1dc33c047bdde07b8e94271ee16a4743e7214c84e20f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v42/ Frame 3BB6 28 KB
28 KB 30ms
8ms Font
font/woff2 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v42/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a67d07f733785876b3192826e76f537e2b9dc0be172ce52c773d30d65f712a07

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Tue, 15 Mar 2022 22:46:42 GMT
x-content-type-options: nosniff
age: 222377
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28328
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 21:57:43 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 15 Mar 2023 22:46:42 GMT

POST
H3 200 1a Show response
i.clean.gg/ Frame F9A0 0
15 B 104ms
94ms XHR
application/octet-stream 34.95.69.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Requested by: Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
via: 1.1 google
server: nginx/1.21.6
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-allow-methods: GET, POST, OPTIONS
content-type: application/octet-stream
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Range
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

OPTIONS
H2 204 1a
i.clean.gg/ Frame 0
0 116ms
93ms Preflight
text/plain 34.95.69.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://i.clean.gg/1a
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.95.69.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.69.95.34.bc.googleusercontent.com
Software: nginx/1.21.6 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

server: nginx/1.21.6
date: Fri, 18 Mar 2022 12:32:59 GMT
access-control-allow-origin: *
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Origin,Accept,X-API-Key
access-control-max-age: 1728000
content-type: text/plain; charset=utf-8
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 200
OK if Show response
ams1-ib.adnxs.com/ Frame 9D00 9 KB
6 KB 15ms
15ms Document
text/html 185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLgMPBMYBgAAAMA1gAFAQj799GRBhCtguap8-T2twcYk-vb_8-toa9HKjYJGohlM4ekhj8RSNPq9Tgdgj8ZAAAAoJmZqT8hSNPq9Tgdgj8pGogJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3ZGdHJDX0hzMlFHVGxOR0pWY1ZQYXZpSXNaNjhzUExmemFnTHJXbnUzazlmSWJudWJrelFSSWNQbFlNYmJ4YUppZmtobEtYcE5mTDgwVWZSZWk5M1ZMLWVVTWJuZGt6U1N3TzZVMl9aS3lxUHFIUmJHOEhGeVdVUlU2czc5RWdYOUZFWXZTUHVWVGwzMzZBLTJueE4xekszSDdpNmlHdHVjaFpXX0VicXlKaHh0bkVUVHhWOVFubGVrZk5UVVFlcVkwMHpyV0g2WTZXb0YzcVhFQVBwM3YwdkpMQzhoeDZGMGVUOUhtM3BLejRlTWdKNmVrWk1SdGczOWh1d2JFSWh2VlZ4OTAzVHNCek5oVXptdnUwRjZWWmJDcEJqTFFWaGlfUnItdl8yNkNYbnVYcEd6bFJqVms0ZWloa091Nl9zNGxiZVJGJTI1MjZzYWklMjUzREFNZmwtWVRqX2Z2S0FEYVVWZTlVSVBiazBjSEtjcEhFWTNPWXNzMFhLdl90Rk1DNkNGbU5OOGFYUVpGZlFFUVJuLW5Qa0hIbWlHWTFId3d6Nmd0WFdjbEdCOXF6Q3VDSjBoQUF0ZmJDWU5pVjNDZGpNZndLejNlaGh5aTBGUW5JV0t3JTI1MjZzaWclMjUzRENnMEFyS0pTekdlTDFSTjNwaUVPRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGW9P0HOi8vd2hlcmVnb2VzLmNvbS_yAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgkxMjk2MjQ3ODnyAp0QCgtQUkVfU0NSSVBUUxKNEDxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjsvKgoKIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCmZ1bmN0aW9uIGsoYil7a1siICJdKGIpO3JldHVybiBifWtbIiAiXT1mdW5jdGlvbigpe307ZnVuY3Rpb24gbCgpe3ZhciBiPWRvY3VtZW50LmN1cnJlbnRTY3JpcHQ7cmV0dXJuKGI9dm9pZCAwPT09Yj9udWxsOmIpJiYiNzciPT09Yi5nZXRBdHRyaWJ1dGUoImRhdGEtamMiKT9iOmRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoJ1tkYXRhLWpjPSI3NyJdJyl9O3ZhciBuPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdW5jdGlvbiBwKCl7dmFyIGI9aDt2YXIgYz1bXTt2YXIgZT1udWxsO2Rve3ZhciBhPWI7dHJ5e3ZhciBkO2lmKGQ9ISFhJiZudWxsIT1hLmxvY2F0aW9uLmhyZWYpYjp7dHJ5e2soYS5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZD0hMX12YXIgZz1kfWNhdGNoKG0pe2c9ITF9aWYoZyl7dmFyIGY9YS5sb2NhdGlvbi5ocmVmO2U9YS5kb2N1bWVudCYmYS5kb2N1bWVudC5yZWZlcnJlcnx8bnVsbH1lbHNlIGY9ZSxlPW51bGw7Yy5wdXNoKG5ldyBxKGZ8fCIiKSk7dHJ5e2I9YS5wYXJlbnR9Y2F0Y2gobSl7Yj1udWxsfX13aGlsZShiJiZhIT1iKTthPTA7Zm9yKGI9Yy5sZW5ndGgtMTthPD1iOysrYSljW2FdLmRlcHRoPWItYTthPWg7aWYoYS5sb2NhdGlvbiYmYS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMmJmEubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zLmxlbmd0aD09Yy5sZW5ndGgtMSlmb3IoYj0xO2I8Yy5sZW5ndGg7KytiKWY9Y1tiXSxmLnVybHx8KGYudXJsPWEubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zW2ItCjFdfHwiIixmLmg9ITApO2E9bmV3IHEoaC5sb2NhdGlvbi5ocmVmLCExKTtmPW51bGw7Zm9yKGU9Yj1jLmxlbmd0aC0xOzA8PWU7LS1lKWlmKGc9Y1tlXSwhZiYmbi50ZXN0KGcudXJsKSYmKGY9ZyksZy51cmwmJiFnLmgpe2E9ZzticmVha31mPW51bGw7ZT1jLmxlbmd0aCYmY1tiXS51cmw7MCE9YS5kZXB0aCYmZSYmKGY9Y1tiXSk7Yz1uZXcgcihhLGYpO3JldHVybiBjLmc_Yy5nLnVybDpjLmkudXJsfWZ1bmN0aW9uIHIoYixjKXt0aGlzLmk9Yjt0aGlzLmc9Y31mdW5jdGlvbiBxKGIsYyl7dGhpcy51cmw9Yjt0aGlzLmg9ISFjO3RoaXMuZGVwdGg9bnVsbH07ZnVuY3Rpb24gdCgpe3ZhciBiPXAoKSxjPWIuaW5kZXhPZigiPyIpO3NldFRpbWVvdXQoZnVuY3Rpb24oKXt2YXIgZT12b2lkIDA9PT1lPy4wMTplO2lmKCEoTWF0aC5yYW5kb20oKT5lKSl7dmFyIGE9bCgpO2E9Imh0dHBzOi8vIisoYSYmInRydWUiPT09YS5nZXRBdHRyaWJ1dGUoImRhdGEtamMtcmNkIik_InBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24tY24uY29tIjoicGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20iKSsiL3BhZ2VhZC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSI7dmFyIGQ9KGQ9bCgpKSYmZC5nZXRBdHRyaWJ1dGUoImRhdGEtamMtdmVyc2lvbiIpfHwidW5rbm93biI7ZT1hK2QrIiZzYW1wbGU9IitlO2E9d2luZG93O2lmKGQ9YS5uYXZpZ2F0b3IpZD1hLm5hdmlnYXRvci51c2VyQWdlbnQsZD0vQ2hyb21lLy50ZXN0KGQpJiYhL0VkZ2UvLnRlc3QoZCk_ITA6ITE7ZCYmYS5uYXZpZ2F0b3Iuc2VuZEJlYWNvbj9hLm5hdmlnYXRvci5zZW5kQmVhY29uKGUpOgooYS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cz1bXSksZD1hLmRvY3VtZW50LGQ9dm9pZCAwPT09ZD9kb2N1bWVudDpkLGQ9ZC5jcmVhdGVFbGVtZW50KCJpbWciKSxkLnNyYz1lLGEuKcJ0X2ltYWdlX3JlcXVlc3RzLnB1c2goZCkpfX0sMCk7zeOIMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9d2luZG93LnJmbD1xIAgoKXsNNfC2ZW5jb2RlVVJJQ29tcG9uZW50KHQoKSl9O30pLmNhbGwodGhpcyk7Cjwvc2NyaXB0PvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eWxlPSJwb3NpdGlvbjogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wOiAwcHg7IHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgc3JjPSJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpSacALwkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG8HlfYj1BS0FtZi1ET1RhMHh5ZVRqQUJMWWFYU2M1bWdha1dyWHNTY1Y4M0lEZWo2WXUyUkRfZzhGVU1MOUNIdHZLa1dXTEF2eHB0YllSdDk3ZUpKMktXMm1sQmQ5eW5qSnVEQnZGQSIgYm9yZGVyPTAgd2lkdGg9MSBoZQ4TCSg9MSBhbHQ9IiIgcykagGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQxZvCQSIARpvCQwgc3JjOQhJCAhhZHNGlQwxBjx4YmZlX2JhY2tmaWxsLmpzAWUAcym1DVMEPihZASAge3IzcHgoJzEe-gkgJyk7fSkoKTs8ETUY8gL5EAoQSAGdNFBPUlRfUEFSQU1TEuQQHpcKipQA8H1hZGZldGNoP2Fkaz0yOTM4MjYwNTQyJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTE5My4yNy4xNC4yNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wb3NFijBfc3RhcnQ9MSZ1cmw9Ebs2UgsQJnN1Yl8NhvRwA2JpZGRlci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1KWHRhZ0FPRDdRQXRCTzBBRzhidEFENVZUUUJEbWcwQWJGck5BRlJjalFCcUhJMEFjaHlOQUUxY3pRQmNITTBBVlowTkFHR2REUUJ3M1EwQWVKME5BSHZkRFFCOTNRMEFSQjFOQUVXZFRRQktIVTBBVHQxTkFGRmRUUUJSblUwQVV0MU5BRk1kVFFCVW5VMEFWbDFOQUZjZFRRQmJYVTBBVzUxTkFGN2RUUUJmSFUwQVg5MU5BR0VkVFFCaVhVMEFZcDFOQUdaZFRRQnBIVTBBVXR6UVFGVGMwRUJnX3paQWN3ZFhBTHVIVndDSEI1Y0FrUDZpQUpfLW9nQ0owS3FBaWhDcWdLQlFxb0NMVW1xQWc5V3FnSi1ZcW9DRjJTcUFoSm9xZ0w5ZUtvQ3JZV3FBcTZScWdLQW02b0NnWnVxQW9LYnFnTEpvNm9Db3FpcUFpMnNxZ0xMemFvQzQ4LXFBaFRScWdMNTFLb0NiOWVxQW5mWHFnSzYycW9DVGR5cUFrdmRxZ0x3M3FvQ3lPS3FBdGpqcWdLZzVhb0N1ZW1xQWducXFnSTQ2cW9DNmVxcUF0X3JxZ0w4N0tvQy1lMnFBZ0x2cWdMbThLb0NGX0dxQWtQeXFnSko4cW9DdWZLcUFndnpxZ0lUODZvQ3dmT3FBaF8wcWdMbTlLb0NpZldxQXVEMXFnTGo5YW9DTmZhcUFvZjJxZ0tMOXFvQzBQYXFBclAzcWdMcjk2b0NUZmlxQW9UNHFnS1YtS29DdnZpcUFsbjVxZ0phLWFvQ3JfbXFBbHI2cWdMRy1xb0NKdnVxQWtIN3FnS3dfS29DdV95cUFqXzlxZ0laX3FvQ0pmNnFBaV8tcWdKal9xb0NnXzZxQXZWMEpBU3BzOFVGOEVMY0NkQ0dJd3Iya2ZzU0NxajdFZ09zLXhJX3Nmc1MwN243RXRtXy14Sjl3ZnNTSWNYN0VwM1IteEsyMXZzU2Y5bjdFb0hhLXhJejR2c1NNLVQ3RXJ2bC14SkI3ZnNTYXUzN0VwdnUteExHN19zU3ZfTDdFbUgwLXhLZTlQc1NzUFQ3RXJ6MC14SWY5ZnNTNFBYN0VnbjIteEt3OVFNVi1sWnJHc3JMdFM0JmV4az0xMjk2MjQ3ODkmqawAY62s8LBCeWN4VFZjd0N2RlJSTUkzRnZ4NzFFc1FCSEVKM05KdHhmNlZPVkh1dTZrNHdidXZleVVpdWVVVGlZRnA4eXZ5bV9qV3RocjlSTFl0MFB5QWplNjhTd0dwbVFSV1RTRDNNRlJja3ozcXFFNjk0ZHM4Z1B6N1dPVXNaU3c2RGVWQWZ3SktZVW5xMlV2bUxfLVprRmpQcDJvOV9DNHJpSjlBTUJqdUZpdlYzdk5jZ0NyYmfNbABkDcD0cANBSE9Mb1lfTTgxT2U4bk1yU1BjMURXVWZ0Y2JrYXl2YXBQd1MtUV9IWnpGRy1BTHFscW93TENzVkNzUXJOM1ppRGdUWGtwcG1FQU8wc1BNWFp0Q2NSb3hXLVlib2xwaU1YeDRHMzdaVUJKbE1NTklfcEM2SFlVX3ZIamNkWmxIY3FDejViZ3oyem8wb0lWUXU0T0wtSC0zcjY3ZjFDMldJZlJrQkpuZUxyR2VuTl9nTjJRaXYyRUNyWVNNRWdXVWh2Xy1YZmV5eUFIN3BxTjNTclpGdUlfTFZib0hZOTlWZFl3VmtjdS05ZWpDdDhJWlhlVzN2aV9xcjJNWGREQVJTZWF0a1kyNHZKNFlaY0dRU2h4djk0STNNY2FMWHhwNXh0VE9TaWpWNkJ4UVkxMU1JN0pFLWdRMS1TQWFNcDE1aXJzRFlXb0FXaEFscm1pWVFTMEJqeWZ1MDBsaUNQSFptcGpwRDVnYXUtLTV6VHh3VTRic3k3MXlXS1NDeE5mNk9pcWZhZE42aE1iMXg4bDY3aEpTb256aXdyaEVtM2dqN0UyMG5JTk81SUkwQTlnNmRkbUdNR2dMaTBkdGRBQzRKZHRkWUhlakRZenBYSmxqYnhfQjdsY2ZBdWtxUFNxX0pWS0hJOTVnMExTUkI4NUtwUkRCWEIxanZwbU84bzJOUnNUVUI5UkF5OXVTNDBIektvTG95SzlWcHhaUU5BSDBLR3lHb2IyTWtUOGJIZkxtRlpwR0FPSDE1alhpVmJ5NUlxM05HaDhmcnZnQ25vNXhJQlE5dl8wOVp4eDY3d3pHYXIzVW9EZllkb3MtTFo2UlBoRHd2RjFmYlFGOEEwYmFEM2NQZEpuQmQxY3RhdHdobnhfQkx1eEdyQTRsdl9XdW9falpJX21nVHBSSC1JeGVlZURMaFdTQUJUdzRqMHB4VnNlZFFWWF8xdWQxdnVhbmJrSXFPZmR0cllXU1o4eGpyLTBxZTdLQWoyaC14d2RjUDdjU3VObG1EQVBsWTZiV2NYMnFBdUd6SkhuUlhDckpMdGtkOUNtcWZZeXdmWUJyNVVwM0RFS08yZW1nQ1JGZEFBJmNpZD1DQUFTQk9Sb0Y2NCZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-kBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb-IWCvC8QnJPQWpRSUtYZkZxMkhiMFJZUXhtcm13dXVKWThlZlhNdF9IcVBYVjdmRENvNGlHN0JfTV9hZnFtSWF4YjB5Rl8wZUZqeUNvUDNUa3Mzd2s0alRHeElfTjB4ZEEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSNTM1ODg3ODQyMTIzNTQ2OTI1Igg3NzIyMTc5MyoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQMLv8IkKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8AQOJRdYiAUBmAUAoAWAocbTx53dy0fABQDJBQAFARTwP9IFCQkFC0AAAADYBQHgBQHwBeikO_oFBAFbKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAYqI4AYB8gYCCACABwGIBwCgBwGqBwwxMzMxNTc0NzE5MDe6Bw8BWA2zJL8GQADIBwDSBw0VhAFFCNoHBgklROAHAOoHAggA8AfkwgGKCAIQAA..&s=4967fe110fe6aa6a693b6b7d3bba9dc5d7672ad6

Requested by

Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

b1d9a33d50e3d7cc38207a556e1dd17414b99d60dcf9d6350405bc6382abce72

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/

Response headers

Server: nginx/1.21.3
Date: Fri, 18 Mar 2022 12:32:59 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
X-Creative-ID: 77221793
AN-X-Request-Uuid: ed7c8adf-d419-4375-8816-1c14d95c0f57
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
Content-Encoding: gzip

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 0460 52 KB
17 KB 90ms
20ms Document
text/html 104.108.144.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com
URL: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.200 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-200.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Content-Type: text/html
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Sat, 19 Mar 2022 12:33:01 GMT
Date: Fri, 18 Mar 2022 12:32:59 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame F9A0 0
0 49ms
48ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstWjThWtwn2cJ1QVHoxZjsF5qsRA3pAxoaYrdgjSodzElL4KfaZG4JVehW-XLClMSIuT9y_aM1VQgNyyqkFaC6VHzGXV6YG8buIkGAAHXyX562cJmhDFHhHh5A6mZjES61jIP2BFZdbKMn0xjlvGiXir3aUuIulC5zpQylTtdPDJAbAoM4N0c02tuDF2N5Rnfb3R64Ex-2wqyweIghIOrQlWNJuiOtYqPSZAVvugyfkpQ5w17OntNDtkA2TZWpuu_fIZPvIlwHsAAZFggcGC5yJTrYElvlRDAlF3kTxHlw5EjO1NA1q56U02dOk5WJFaZOPDt5EJ6O30Qw&sai=AMfl-YRTU9-1Dmg8dnHYLI3deaq3tG80TB8upOXc4-t99phJtzP0vpvcqYDuWG7CfGmWB1IAJa6XiqD5aCOpPf4PKfPiG4cMSFUzsxPv2QcXqVD19nUViR8EDO0j9lOR4dg&sig=Cg0ArKJSzH70Vka3RB5nEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
DATA 200
OK truncated
/ Frame F9A0 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 10477c66ce5b38f10b6683eb65b7dced929ffde4ef798c59b788a9c90052f2cf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9D00 0
20 B 42ms
41ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-DOTa0xyeTjABLYaXSc5mgakWrXsScV83IDej6Yu2RD_g8FUML9CHtvKkWWLAvxptbYRt97eJJ2KW2mlBd9ynjJuDBvFA

Requested by

Host: ams1-ib.adnxs.com
URL: https://ams1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLgMPBMYBgAAAMA1gAFAQj799GRBhCtguap8-T2twcYk-vb_8-toa9HKjYJGohlM4ekhj8RSNPq9Tgdgj8ZAAAAoJmZqT8hSNPq9Tgdgj8pGogJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3ZGdHJDX0hzMlFHVGxOR0pWY1ZQYXZpSXNaNjhzUExmemFnTHJXbnUzazlmSWJudWJrelFSSWNQbFlNYmJ4YUppZmtobEtYcE5mTDgwVWZSZWk5M1ZMLWVVTWJuZGt6U1N3TzZVMl9aS3lxUHFIUmJHOEhGeVdVUlU2czc5RWdYOUZFWXZTUHVWVGwzMzZBLTJueE4xekszSDdpNmlHdHVjaFpXX0VicXlKaHh0bkVUVHhWOVFubGVrZk5UVVFlcVkwMHpyV0g2WTZXb0YzcVhFQVBwM3YwdkpMQzhoeDZGMGVUOUhtM3BLejRlTWdKNmVrWk1SdGczOWh1d2JFSWh2VlZ4OTAzVHNCek5oVXptdnUwRjZWWmJDcEJqTFFWaGlfUnItdl8yNkNYbnVYcEd6bFJqVms0ZWloa091Nl9zNGxiZVJGJTI1MjZzYWklMjUzREFNZmwtWVRqX2Z2S0FEYVVWZTlVSVBiazBjSEtjcEhFWTNPWXNzMFhLdl90Rk1DNkNGbU5OOGFYUVpGZlFFUVJuLW5Qa0hIbWlHWTFId3d6Nmd0WFdjbEdCOXF6Q3VDSjBoQUF0ZmJDWU5pVjNDZGpNZndLejNlaGh5aTBGUW5JV0t3JTI1MjZzaWclMjUzRENnMEFyS0pTekdlTDFSTjNwaUVPRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGW9P0HOi8vd2hlcmVnb2VzLmNvbS_yAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgkxMjk2MjQ3ODnyAp0QCgtQUkVfU0NSSVBUUxKNEDxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjsvKgoKIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCmZ1bmN0aW9uIGsoYil7a1siICJdKGIpO3JldHVybiBifWtbIiAiXT1mdW5jdGlvbigpe307ZnVuY3Rpb24gbCgpe3ZhciBiPWRvY3VtZW50LmN1cnJlbnRTY3JpcHQ7cmV0dXJuKGI9dm9pZCAwPT09Yj9udWxsOmIpJiYiNzciPT09Yi5nZXRBdHRyaWJ1dGUoImRhdGEtamMiKT9iOmRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoJ1tkYXRhLWpjPSI3NyJdJyl9O3ZhciBuPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdW5jdGlvbiBwKCl7dmFyIGI9aDt2YXIgYz1bXTt2YXIgZT1udWxsO2Rve3ZhciBhPWI7dHJ5e3ZhciBkO2lmKGQ9ISFhJiZudWxsIT1hLmxvY2F0aW9uLmhyZWYpYjp7dHJ5e2soYS5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZD0hMX12YXIgZz1kfWNhdGNoKG0pe2c9ITF9aWYoZyl7dmFyIGY9YS5sb2NhdGlvbi5ocmVmO2U9YS5kb2N1bWVudCYmYS5kb2N1bWVudC5yZWZlcnJlcnx8bnVsbH1lbHNlIGY9ZSxlPW51bGw7Yy5wdXNoKG5ldyBxKGZ8fCIiKSk7dHJ5e2I9YS5wYXJlbnR9Y2F0Y2gobSl7Yj1udWxsfX13aGlsZShiJiZhIT1iKTthPTA7Zm9yKGI9Yy5sZW5ndGgtMTthPD1iOysrYSljW2FdLmRlcHRoPWItYTthPWg7aWYoYS5sb2NhdGlvbiYmYS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMmJmEubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zLmxlbmd0aD09Yy5sZW5ndGgtMSlmb3IoYj0xO2I8Yy5sZW5ndGg7KytiKWY9Y1tiXSxmLnVybHx8KGYudXJsPWEubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zW2ItCjFdfHwiIixmLmg9ITApO2E9bmV3IHEoaC5sb2NhdGlvbi5ocmVmLCExKTtmPW51bGw7Zm9yKGU9Yj1jLmxlbmd0aC0xOzA8PWU7LS1lKWlmKGc9Y1tlXSwhZiYmbi50ZXN0KGcudXJsKSYmKGY9ZyksZy51cmwmJiFnLmgpe2E9ZzticmVha31mPW51bGw7ZT1jLmxlbmd0aCYmY1tiXS51cmw7MCE9YS5kZXB0aCYmZSYmKGY9Y1tiXSk7Yz1uZXcgcihhLGYpO3JldHVybiBjLmc_Yy5nLnVybDpjLmkudXJsfWZ1bmN0aW9uIHIoYixjKXt0aGlzLmk9Yjt0aGlzLmc9Y31mdW5jdGlvbiBxKGIsYyl7dGhpcy51cmw9Yjt0aGlzLmg9ISFjO3RoaXMuZGVwdGg9bnVsbH07ZnVuY3Rpb24gdCgpe3ZhciBiPXAoKSxjPWIuaW5kZXhPZigiPyIpO3NldFRpbWVvdXQoZnVuY3Rpb24oKXt2YXIgZT12b2lkIDA9PT1lPy4wMTplO2lmKCEoTWF0aC5yYW5kb20oKT5lKSl7dmFyIGE9bCgpO2E9Imh0dHBzOi8vIisoYSYmInRydWUiPT09YS5nZXRBdHRyaWJ1dGUoImRhdGEtamMtcmNkIik_InBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24tY24uY29tIjoicGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20iKSsiL3BhZ2VhZC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSI7dmFyIGQ9KGQ9bCgpKSYmZC5nZXRBdHRyaWJ1dGUoImRhdGEtamMtdmVyc2lvbiIpfHwidW5rbm93biI7ZT1hK2QrIiZzYW1wbGU9IitlO2E9d2luZG93O2lmKGQ9YS5uYXZpZ2F0b3IpZD1hLm5hdmlnYXRvci51c2VyQWdlbnQsZD0vQ2hyb21lLy50ZXN0KGQpJiYhL0VkZ2UvLnRlc3QoZCk_ITA6ITE7ZCYmYS5uYXZpZ2F0b3Iuc2VuZEJlYWNvbj9hLm5hdmlnYXRvci5zZW5kQmVhY29uKGUpOgooYS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cz1bXSksZD1hLmRvY3VtZW50LGQ9dm9pZCAwPT09ZD9kb2N1bWVudDpkLGQ9ZC5jcmVhdGVFbGVtZW50KCJpbWciKSxkLnNyYz1lLGEuKcJ0X2ltYWdlX3JlcXVlc3RzLnB1c2goZCkpfX0sMCk7zeOIMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9d2luZG93LnJmbD1xIAgoKXsNNfC2ZW5jb2RlVVJJQ29tcG9uZW50KHQoKSl9O30pLmNhbGwodGhpcyk7Cjwvc2NyaXB0PvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eWxlPSJwb3NpdGlvbjogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wOiAwcHg7IHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgc3JjPSJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpSacALwkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG8HlfYj1BS0FtZi1ET1RhMHh5ZVRqQUJMWWFYU2M1bWdha1dyWHNTY1Y4M0lEZWo2WXUyUkRfZzhGVU1MOUNIdHZLa1dXTEF2eHB0YllSdDk3ZUpKMktXMm1sQmQ5eW5qSnVEQnZGQSIgYm9yZGVyPTAgd2lkdGg9MSBoZQ4TCSg9MSBhbHQ9IiIgcykagGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQxZvCQSIARpvCQwgc3JjOQhJCAhhZHNGlQwxBjx4YmZlX2JhY2tmaWxsLmpzAWUAcym1DVMEPihZASAge3IzcHgoJzEe-gkgJyk7fSkoKTs8ETUY8gL5EAoQSAGdNFBPUlRfUEFSQU1TEuQQHpcKipQA8H1hZGZldGNoP2Fkaz0yOTM4MjYwNTQyJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTE5My4yNy4xNC4yNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wb3NFijBfc3RhcnQ9MSZ1cmw9Ebs2UgsQJnN1Yl8NhvRwA2JpZGRlci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1KWHRhZ0FPRDdRQXRCTzBBRzhidEFENVZUUUJEbWcwQWJGck5BRlJjalFCcUhJMEFjaHlOQUUxY3pRQmNITTBBVlowTkFHR2REUUJ3M1EwQWVKME5BSHZkRFFCOTNRMEFSQjFOQUVXZFRRQktIVTBBVHQxTkFGRmRUUUJSblUwQVV0MU5BRk1kVFFCVW5VMEFWbDFOQUZjZFRRQmJYVTBBVzUxTkFGN2RUUUJmSFUwQVg5MU5BR0VkVFFCaVhVMEFZcDFOQUdaZFRRQnBIVTBBVXR6UVFGVGMwRUJnX3paQWN3ZFhBTHVIVndDSEI1Y0FrUDZpQUpfLW9nQ0owS3FBaWhDcWdLQlFxb0NMVW1xQWc5V3FnSi1ZcW9DRjJTcUFoSm9xZ0w5ZUtvQ3JZV3FBcTZScWdLQW02b0NnWnVxQW9LYnFnTEpvNm9Db3FpcUFpMnNxZ0xMemFvQzQ4LXFBaFRScWdMNTFLb0NiOWVxQW5mWHFnSzYycW9DVGR5cUFrdmRxZ0x3M3FvQ3lPS3FBdGpqcWdLZzVhb0N1ZW1xQWducXFnSTQ2cW9DNmVxcUF0X3JxZ0w4N0tvQy1lMnFBZ0x2cWdMbThLb0NGX0dxQWtQeXFnSko4cW9DdWZLcUFndnpxZ0lUODZvQ3dmT3FBaF8wcWdMbTlLb0NpZldxQXVEMXFnTGo5YW9DTmZhcUFvZjJxZ0tMOXFvQzBQYXFBclAzcWdMcjk2b0NUZmlxQW9UNHFnS1YtS29DdnZpcUFsbjVxZ0phLWFvQ3JfbXFBbHI2cWdMRy1xb0NKdnVxQWtIN3FnS3dfS29DdV95cUFqXzlxZ0laX3FvQ0pmNnFBaV8tcWdKal9xb0NnXzZxQXZWMEpBU3BzOFVGOEVMY0NkQ0dJd3Iya2ZzU0NxajdFZ09zLXhJX3Nmc1MwN243RXRtXy14Sjl3ZnNTSWNYN0VwM1IteEsyMXZzU2Y5bjdFb0hhLXhJejR2c1NNLVQ3RXJ2bC14SkI3ZnNTYXUzN0VwdnUteExHN19zU3ZfTDdFbUgwLXhLZTlQc1NzUFQ3RXJ6MC14SWY5ZnNTNFBYN0VnbjIteEt3OVFNVi1sWnJHc3JMdFM0JmV4az0xMjk2MjQ3ODkmqawAY62s8LBCeWN4VFZjd0N2RlJSTUkzRnZ4NzFFc1FCSEVKM05KdHhmNlZPVkh1dTZrNHdidXZleVVpdWVVVGlZRnA4eXZ5bV9qV3RocjlSTFl0MFB5QWplNjhTd0dwbVFSV1RTRDNNRlJja3ozcXFFNjk0ZHM4Z1B6N1dPVXNaU3c2RGVWQWZ3SktZVW5xMlV2bUxfLVprRmpQcDJvOV9DNHJpSjlBTUJqdUZpdlYzdk5jZ0NyYmfNbABkDcD0cANBSE9Mb1lfTTgxT2U4bk1yU1BjMURXVWZ0Y2JrYXl2YXBQd1MtUV9IWnpGRy1BTHFscW93TENzVkNzUXJOM1ppRGdUWGtwcG1FQU8wc1BNWFp0Q2NSb3hXLVlib2xwaU1YeDRHMzdaVUJKbE1NTklfcEM2SFlVX3ZIamNkWmxIY3FDejViZ3oyem8wb0lWUXU0T0wtSC0zcjY3ZjFDMldJZlJrQkpuZUxyR2VuTl9nTjJRaXYyRUNyWVNNRWdXVWh2Xy1YZmV5eUFIN3BxTjNTclpGdUlfTFZib0hZOTlWZFl3VmtjdS05ZWpDdDhJWlhlVzN2aV9xcjJNWGREQVJTZWF0a1kyNHZKNFlaY0dRU2h4djk0STNNY2FMWHhwNXh0VE9TaWpWNkJ4UVkxMU1JN0pFLWdRMS1TQWFNcDE1aXJzRFlXb0FXaEFscm1pWVFTMEJqeWZ1MDBsaUNQSFptcGpwRDVnYXUtLTV6VHh3VTRic3k3MXlXS1NDeE5mNk9pcWZhZE42aE1iMXg4bDY3aEpTb256aXdyaEVtM2dqN0UyMG5JTk81SUkwQTlnNmRkbUdNR2dMaTBkdGRBQzRKZHRkWUhlakRZenBYSmxqYnhfQjdsY2ZBdWtxUFNxX0pWS0hJOTVnMExTUkI4NUtwUkRCWEIxanZwbU84bzJOUnNUVUI5UkF5OXVTNDBIektvTG95SzlWcHhaUU5BSDBLR3lHb2IyTWtUOGJIZkxtRlpwR0FPSDE1alhpVmJ5NUlxM05HaDhmcnZnQ25vNXhJQlE5dl8wOVp4eDY3d3pHYXIzVW9EZllkb3MtTFo2UlBoRHd2RjFmYlFGOEEwYmFEM2NQZEpuQmQxY3RhdHdobnhfQkx1eEdyQTRsdl9XdW9falpJX21nVHBSSC1JeGVlZURMaFdTQUJUdzRqMHB4VnNlZFFWWF8xdWQxdnVhbmJrSXFPZmR0cllXU1o4eGpyLTBxZTdLQWoyaC14d2RjUDdjU3VObG1EQVBsWTZiV2NYMnFBdUd6SkhuUlhDckpMdGtkOUNtcWZZeXdmWUJyNVVwM0RFS08yZW1nQ1JGZEFBJmNpZD1DQUFTQk9Sb0Y2NCZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-kBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb-IWCvC8QnJPQWpRSUtYZkZxMkhiMFJZUXhtcm13dXVKWThlZlhNdF9IcVBYVjdmRENvNGlHN0JfTV9hZnFtSWF4YjB5Rl8wZUZqeUNvUDNUa3Mzd2s0alRHeElfTjB4ZEEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSNTM1ODg3ODQyMTIzNTQ2OTI1Igg3NzIyMTc5MyoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQMLv8IkKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8AQOJRdYiAUBmAUAoAWAocbTx53dy0fABQDJBQAFARTwP9IFCQkFC0AAAADYBQHgBQHwBeikO_oFBAFbKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAYqI4AYB8gYCCACABwGIBwCgBwGqBwwxMzMxNTc0NzE5MDe6Bw8BWA2zJL8GQADIBwDSBw0VhAFFCNoHBgklROAHAOoHAggA8AfkwgGKCAIQAA..&s=4967fe110fe6aa6a693b6b7d3bba9dc5d7672ad6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 9D00 12 KB
5 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8996d7b9fba17a4ad4880bb154f6b56d33f9ff87ecf4f830bc0488cdc1616f55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 11:50:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2553
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5307
x-xss-protection: 0
server: cafe
etag: 5818309846818389003
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 18 Mar 2022 12:50:26 GMT

GET
H/1.1 200
OK it
ams1-ib.adnxs.com/ Frame 9D00 0
813 B 84ms
83ms Image
text/html 185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ams1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QL7CvBMewUAAAMA1gAFAQj799GRBhCtguap8-T2twcYk-vb_8-toa9HKjYJGohlM4ekhj8RSNPq9Tgdgj8ZAAAAoJmZqT8hSNPq9Tgdgj8pGogJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3ZGdHJDX0hzMlFHVGxOR0pWY1ZQYXZpSXNaNjhzUExmemFnTHJXbnUzazlmSWJudWJrelFSSWNQbFlNYmJ4YUppZmtobEtYcE5mTDgwVWZSZWk5M1ZMLWVVTWJuZGt6U1N3TzZVMl9aS3lxUHFIUmJHOEhGeVdVUlU2czc5RWdYOUZFWXZTUHVWVGwzMzZBLTJueE4xekszSDdpNmlHdHVjaFpXX0VicXlKaHh0bkVUVHhWOVFubGVrZk5UVVFlcVkwMHpyV0g2WTZXb0YzcVhFQVBwM3YwdkpMQzhoeDZGMGVUOUhtM3BLejRlTWdKNmVrWk1SdGczOWh1d2JFSWh2VlZ4OTAzVHNCek5oVXptdnUwRjZWWmJDcEJqTFFWaGlfUnItdl8yNkNYbnVYcEd6bFJqVms0ZWloa091Nl9zNGxiZVJGJTI1MjZzYWklMjUzREFNZmwtWVRqX2Z2S0FEYVVWZTlVSVBiazBjSEtjcEhFWTNPWXNzMFhLdl90Rk1DNkNGbU5OOGFYUVpGZlFFUVJuLW5Qa0hIbWlHWTFId3d6Nmd0WFdjbEdCOXF6Q3VDSjBoQUF0ZmJDWU5pVjNDZGpNZndLejNlaGh5aTBGUW5JV0t3JTI1MjZzaWclMjUzRENnMEFyS0pTekdlTDFSTjNwaUVPRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGWmDovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPpAQq_AREsYHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24FPAkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQnJPQWpRSUtYZkZxMkhiMFJZUXhtcm13dXVKWThlZlhNdF9IcVBYVjdmRENvNGlHN0JfTV9hZnFtSWF4YjB5Rl8wZUZqeUNvUDNUa3Mzd2s0alRHeElfTjB4ZEEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSNTM1ODg3ODQyMTIzNTQ2OTI1Igg3NzIyMTc5MyoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQMMTkzLjI3LjE0LjI0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYChxtPHnd3LR8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBeikO_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAEzLgEAmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMzE1NzQ3MTkwN7oHDx2zKL8GQADIBwDSBw0JEUkBRQjaBwYJJUTgBwDqBwIIAPAH5MIBiggCEAA.&s=564aacd6bb8d8ac61ecd73665b5c2f24c7242035

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:59 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 932a72aa-1d8c-463c-b317-2b68359e6641
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 9D00 85 KB
29 KB 7ms
6ms Script
application/x-javascript 151.101.65.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: ams1-ib.adnxs.com
URL: https://ams1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QLgMPBMYBgAAAMA1gAFAQj799GRBhCtguap8-T2twcYk-vb_8-toa9HKjYJGohlM4ekhj8RSNPq9Tgdgj8ZAAAAoJmZqT8hSNPq9Tgdgj8pGogJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3ZGdHJDX0hzMlFHVGxOR0pWY1ZQYXZpSXNaNjhzUExmemFnTHJXbnUzazlmSWJudWJrelFSSWNQbFlNYmJ4YUppZmtobEtYcE5mTDgwVWZSZWk5M1ZMLWVVTWJuZGt6U1N3TzZVMl9aS3lxUHFIUmJHOEhGeVdVUlU2czc5RWdYOUZFWXZTUHVWVGwzMzZBLTJueE4xekszSDdpNmlHdHVjaFpXX0VicXlKaHh0bkVUVHhWOVFubGVrZk5UVVFlcVkwMHpyV0g2WTZXb0YzcVhFQVBwM3YwdkpMQzhoeDZGMGVUOUhtM3BLejRlTWdKNmVrWk1SdGczOWh1d2JFSWh2VlZ4OTAzVHNCek5oVXptdnUwRjZWWmJDcEJqTFFWaGlfUnItdl8yNkNYbnVYcEd6bFJqVms0ZWloa091Nl9zNGxiZVJGJTI1MjZzYWklMjUzREFNZmwtWVRqX2Z2S0FEYVVWZTlVSVBiazBjSEtjcEhFWTNPWXNzMFhLdl90Rk1DNkNGbU5OOGFYUVpGZlFFUVJuLW5Qa0hIbWlHWTFId3d6Nmd0WFdjbEdCOXF6Q3VDSjBoQUF0ZmJDWU5pVjNDZGpNZndLejNlaGh5aTBGUW5JV0t3JTI1MjZzaWclMjUzRENnMEFyS0pTekdlTDFSTjNwaUVPRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGW9P0HOi8vd2hlcmVnb2VzLmNvbS_yAg0KBkhFSUdIVBIDMjUw8gIMCgVXSURUSBIDMzAw8gIhCgZMT0FERVISF3JlbmRlcl9wb3N0X2Fkc192MS5odG1s8gIXCgpJRlJBTUVfS0VZEgkxMjk2MjQ3ODnyAp0QCgtQUkVfU0NSSVBUUxKNEDxzY3JpcHQ-KGZ1bmN0aW9uKCl7LyoKCiBDb3B5cmlnaHQgVGhlIENsb3N1cmUgTGlicmFyeSBBdXRob3JzLgogU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjAKKi8KdmFyIGg9dGhpc3x8c2VsZjsvKgoKIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wCiovCmZ1bmN0aW9uIGsoYil7a1siICJdKGIpO3JldHVybiBifWtbIiAiXT1mdW5jdGlvbigpe307ZnVuY3Rpb24gbCgpe3ZhciBiPWRvY3VtZW50LmN1cnJlbnRTY3JpcHQ7cmV0dXJuKGI9dm9pZCAwPT09Yj9udWxsOmIpJiYiNzciPT09Yi5nZXRBdHRyaWJ1dGUoImRhdGEtamMiKT9iOmRvY3VtZW50LnF1ZXJ5U2VsZWN0b3IoJ1tkYXRhLWpjPSI3NyJdJyl9O3ZhciBuPVJlZ0V4cCgiXmh0dHBzPzovLyhcXHd8LSkrXFwuY2RuXFwuYW1wcHJvamVjdFxcLihuZXR8b3JnKShcXD98L3wkKSIpOwpmdW5jdGlvbiBwKCl7dmFyIGI9aDt2YXIgYz1bXTt2YXIgZT1udWxsO2Rve3ZhciBhPWI7dHJ5e3ZhciBkO2lmKGQ9ISFhJiZudWxsIT1hLmxvY2F0aW9uLmhyZWYpYjp7dHJ5e2soYS5mb28pO2Q9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZD0hMX12YXIgZz1kfWNhdGNoKG0pe2c9ITF9aWYoZyl7dmFyIGY9YS5sb2NhdGlvbi5ocmVmO2U9YS5kb2N1bWVudCYmYS5kb2N1bWVudC5yZWZlcnJlcnx8bnVsbH1lbHNlIGY9ZSxlPW51bGw7Yy5wdXNoKG5ldyBxKGZ8fCIiKSk7dHJ5e2I9YS5wYXJlbnR9Y2F0Y2gobSl7Yj1udWxsfX13aGlsZShiJiZhIT1iKTthPTA7Zm9yKGI9Yy5sZW5ndGgtMTthPD1iOysrYSljW2FdLmRlcHRoPWItYTthPWg7aWYoYS5sb2NhdGlvbiYmYS5sb2NhdGlvbi5hbmNlc3Rvck9yaWdpbnMmJmEubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zLmxlbmd0aD09Yy5sZW5ndGgtMSlmb3IoYj0xO2I8Yy5sZW5ndGg7KytiKWY9Y1tiXSxmLnVybHx8KGYudXJsPWEubG9jYXRpb24uYW5jZXN0b3JPcmlnaW5zW2ItCjFdfHwiIixmLmg9ITApO2E9bmV3IHEoaC5sb2NhdGlvbi5ocmVmLCExKTtmPW51bGw7Zm9yKGU9Yj1jLmxlbmd0aC0xOzA8PWU7LS1lKWlmKGc9Y1tlXSwhZiYmbi50ZXN0KGcudXJsKSYmKGY9ZyksZy51cmwmJiFnLmgpe2E9ZzticmVha31mPW51bGw7ZT1jLmxlbmd0aCYmY1tiXS51cmw7MCE9YS5kZXB0aCYmZSYmKGY9Y1tiXSk7Yz1uZXcgcihhLGYpO3JldHVybiBjLmc_Yy5nLnVybDpjLmkudXJsfWZ1bmN0aW9uIHIoYixjKXt0aGlzLmk9Yjt0aGlzLmc9Y31mdW5jdGlvbiBxKGIsYyl7dGhpcy51cmw9Yjt0aGlzLmg9ISFjO3RoaXMuZGVwdGg9bnVsbH07ZnVuY3Rpb24gdCgpe3ZhciBiPXAoKSxjPWIuaW5kZXhPZigiPyIpO3NldFRpbWVvdXQoZnVuY3Rpb24oKXt2YXIgZT12b2lkIDA9PT1lPy4wMTplO2lmKCEoTWF0aC5yYW5kb20oKT5lKSl7dmFyIGE9bCgpO2E9Imh0dHBzOi8vIisoYSYmInRydWUiPT09YS5nZXRBdHRyaWJ1dGUoImRhdGEtamMtcmNkIik_InBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24tY24uY29tIjoicGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20iKSsiL3BhZ2VhZC9nZW5fMjA0P2lkPWpjYSZqYz03NyZ2ZXJzaW9uPSI7dmFyIGQ9KGQ9bCgpKSYmZC5nZXRBdHRyaWJ1dGUoImRhdGEtamMtdmVyc2lvbiIpfHwidW5rbm93biI7ZT1hK2QrIiZzYW1wbGU9IitlO2E9d2luZG93O2lmKGQ9YS5uYXZpZ2F0b3IpZD1hLm5hdmlnYXRvci51c2VyQWdlbnQsZD0vQ2hyb21lLy50ZXN0KGQpJiYhL0VkZ2UvLnRlc3QoZCk_ITA6ITE7ZCYmYS5uYXZpZ2F0b3Iuc2VuZEJlYWNvbj9hLm5hdmlnYXRvci5zZW5kQmVhY29uKGUpOgooYS5nb29nbGVfaW1hZ2VfcmVxdWVzdHN8fChhLmdvb2dsZV9pbWFnZV9yZXF1ZXN0cz1bXSksZD1hLmRvY3VtZW50LGQ9dm9pZCAwPT09ZD9kb2N1bWVudDpkLGQ9ZC5jcmVhdGVFbGVtZW50KCJpbWciKSxkLnNyYz1lLGEuKcJ0X2ltYWdlX3JlcXVlc3RzLnB1c2goZCkpfX0sMCk7zeOIMDw9Yz9iLnN1YnN0cmluZygwLGMpOmJ9d2luZG93LnJmbD1xIAgoKXsNNfC2ZW5jb2RlVVJJQ29tcG9uZW50KHQoKSl9O30pLmNhbGwodGhpcyk7Cjwvc2NyaXB0PvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eWxlPSJwb3NpdGlvbjogYWJzb2x1dGU7IGxlZnQ6IDBweDsgdG9wOiAwcHg7IHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcgc3JjPSJodHRwczovL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpSacALwkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG8HlfYj1BS0FtZi1ET1RhMHh5ZVRqQUJMWWFYU2M1bWdha1dyWHNTY1Y4M0lEZWo2WXUyUkRfZzhGVU1MOUNIdHZLa1dXTEF2eHB0YllSdDk3ZUpKMktXMm1sQmQ5eW5qSnVEQnZGQSIgYm9yZGVyPTAgd2lkdGg9MSBoZQ4TCSg9MSBhbHQ9IiIgcykagGRpc3BsYXk6bm9uZSI-PC9kaXY-8gKZAQoMUE9TVF9TQxZvCQSIARpvCQwgc3JjOQhJCAhhZHNGlQwxBjx4YmZlX2JhY2tmaWxsLmpzAWUAcym1DVMEPihZASAge3IzcHgoJzEe-gkgJyk7fSkoKTs8ETUY8gL5EAoQSAGdNFBPUlRfUEFSQU1TEuQQHpcKipQA8H1hZGZldGNoP2Fkaz0yOTM4MjYwNTQyJmFkc2FmZT1tZWRpdW0mY2xpZW50PWNhLXB1Yi0zMDc2ODkwMDEyNzQxNDY3JmZvcm1hdD0zMDB4MjUwX2FzJmlwPTE5My4yNy4xNC4yNCZvdXRwdXQ9aHRtbCZ1bnZpZXdlZF9wb3NFijBfc3RhcnQ9MSZ1cmw9Ebs2UgsQJnN1Yl8NhvRwA2JpZGRlci0zMDU2NDQ3JmhsPWRlJmFjZWlkPU1KWHRhZ0FPRDdRQXRCTzBBRzhidEFENVZUUUJEbWcwQWJGck5BRlJjalFCcUhJMEFjaHlOQUUxY3pRQmNITTBBVlowTkFHR2REUUJ3M1EwQWVKME5BSHZkRFFCOTNRMEFSQjFOQUVXZFRRQktIVTBBVHQxTkFGRmRUUUJSblUwQVV0MU5BRk1kVFFCVW5VMEFWbDFOQUZjZFRRQmJYVTBBVzUxTkFGN2RUUUJmSFUwQVg5MU5BR0VkVFFCaVhVMEFZcDFOQUdaZFRRQnBIVTBBVXR6UVFGVGMwRUJnX3paQWN3ZFhBTHVIVndDSEI1Y0FrUDZpQUpfLW9nQ0owS3FBaWhDcWdLQlFxb0NMVW1xQWc5V3FnSi1ZcW9DRjJTcUFoSm9xZ0w5ZUtvQ3JZV3FBcTZScWdLQW02b0NnWnVxQW9LYnFnTEpvNm9Db3FpcUFpMnNxZ0xMemFvQzQ4LXFBaFRScWdMNTFLb0NiOWVxQW5mWHFnSzYycW9DVGR5cUFrdmRxZ0x3M3FvQ3lPS3FBdGpqcWdLZzVhb0N1ZW1xQWducXFnSTQ2cW9DNmVxcUF0X3JxZ0w4N0tvQy1lMnFBZ0x2cWdMbThLb0NGX0dxQWtQeXFnSko4cW9DdWZLcUFndnpxZ0lUODZvQ3dmT3FBaF8wcWdMbTlLb0NpZldxQXVEMXFnTGo5YW9DTmZhcUFvZjJxZ0tMOXFvQzBQYXFBclAzcWdMcjk2b0NUZmlxQW9UNHFnS1YtS29DdnZpcUFsbjVxZ0phLWFvQ3JfbXFBbHI2cWdMRy1xb0NKdnVxQWtIN3FnS3dfS29DdV95cUFqXzlxZ0laX3FvQ0pmNnFBaV8tcWdKal9xb0NnXzZxQXZWMEpBU3BzOFVGOEVMY0NkQ0dJd3Iya2ZzU0NxajdFZ09zLXhJX3Nmc1MwN243RXRtXy14Sjl3ZnNTSWNYN0VwM1IteEsyMXZzU2Y5bjdFb0hhLXhJejR2c1NNLVQ3RXJ2bC14SkI3ZnNTYXUzN0VwdnUteExHN19zU3ZfTDdFbUgwLXhLZTlQc1NzUFQ3RXJ6MC14SWY5ZnNTNFBYN0VnbjIteEt3OVFNVi1sWnJHc3JMdFM0JmV4az0xMjk2MjQ3ODkmqawAY62s8LBCeWN4VFZjd0N2RlJSTUkzRnZ4NzFFc1FCSEVKM05KdHhmNlZPVkh1dTZrNHdidXZleVVpdWVVVGlZRnA4eXZ5bV9qV3RocjlSTFl0MFB5QWplNjhTd0dwbVFSV1RTRDNNRlJja3ozcXFFNjk0ZHM4Z1B6N1dPVXNaU3c2RGVWQWZ3SktZVW5xMlV2bUxfLVprRmpQcDJvOV9DNHJpSjlBTUJqdUZpdlYzdk5jZ0NyYmfNbABkDcD0cANBSE9Mb1lfTTgxT2U4bk1yU1BjMURXVWZ0Y2JrYXl2YXBQd1MtUV9IWnpGRy1BTHFscW93TENzVkNzUXJOM1ppRGdUWGtwcG1FQU8wc1BNWFp0Q2NSb3hXLVlib2xwaU1YeDRHMzdaVUJKbE1NTklfcEM2SFlVX3ZIamNkWmxIY3FDejViZ3oyem8wb0lWUXU0T0wtSC0zcjY3ZjFDMldJZlJrQkpuZUxyR2VuTl9nTjJRaXYyRUNyWVNNRWdXVWh2Xy1YZmV5eUFIN3BxTjNTclpGdUlfTFZib0hZOTlWZFl3VmtjdS05ZWpDdDhJWlhlVzN2aV9xcjJNWGREQVJTZWF0a1kyNHZKNFlaY0dRU2h4djk0STNNY2FMWHhwNXh0VE9TaWpWNkJ4UVkxMU1JN0pFLWdRMS1TQWFNcDE1aXJzRFlXb0FXaEFscm1pWVFTMEJqeWZ1MDBsaUNQSFptcGpwRDVnYXUtLTV6VHh3VTRic3k3MXlXS1NDeE5mNk9pcWZhZE42aE1iMXg4bDY3aEpTb256aXdyaEVtM2dqN0UyMG5JTk81SUkwQTlnNmRkbUdNR2dMaTBkdGRBQzRKZHRkWUhlakRZenBYSmxqYnhfQjdsY2ZBdWtxUFNxX0pWS0hJOTVnMExTUkI4NUtwUkRCWEIxanZwbU84bzJOUnNUVUI5UkF5OXVTNDBIektvTG95SzlWcHhaUU5BSDBLR3lHb2IyTWtUOGJIZkxtRlpwR0FPSDE1alhpVmJ5NUlxM05HaDhmcnZnQ25vNXhJQlE5dl8wOVp4eDY3d3pHYXIzVW9EZllkb3MtTFo2UlBoRHd2RjFmYlFGOEEwYmFEM2NQZEpuQmQxY3RhdHdobnhfQkx1eEdyQTRsdl9XdW9falpJX21nVHBSSC1JeGVlZURMaFdTQUJUdzRqMHB4VnNlZFFWWF8xdWQxdnVhbmJrSXFPZmR0cllXU1o4eGpyLTBxZTdLQWoyaC14d2RjUDdjU3VObG1EQVBsWTZiV2NYMnFBdUd6SkhuUlhDckpMdGtkOUNtcWZZeXdmWUJyNVVwM0RFS08yZW1nQ1JGZEFBJmNpZD1DQUFTQk9Sb0Y2NCZhX2NpZD2AAwCIAwGQAwCYAxmgAwGqA-kBCr8BaHR0cHM6Ly9wYWdlYWQyLmdvb-IWCvC8QnJPQWpRSUtYZkZxMkhiMFJZUXhtcm13dXVKWThlZlhNdF9IcVBYVjdmRENvNGlHN0JfTV9hZnFtSWF4YjB5Rl8wZUZqeUNvUDNUa3Mzd2s0alRHeElfTjB4ZEEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSNTM1ODg3ODQyMTIzNTQ2OTI1Igg3NzIyMTc5MyoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQMLv8IkKgEALIEDAgAEAAYACAAMAA4ALgEAMAEAMgEANoEAggB4AQA8AQOJRdYiAUBmAUAoAWAocbTx53dy0fABQDJBQAFARTwP9IFCQkFC0AAAADYBQHgBQHwBeikO_oFBAFbKJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBAYqI4AYB8gYCCACABwGIBwCgBwGqBwwxMzMxNTc0NzE5MDe6Bw8BWA2zJL8GQADIBwDSBw0VhAFFCNoHBgklROAHAOoHAggA8AfkwgGKCAIQAA..&s=4967fe110fe6aa6a693b6b7d3bba9dc5d7672ad6
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:32:59 GMT
Content-Encoding: gzip
Age: 1913668
X-Cache: HIT, HIT
Connection: keep-alive
Content-Length: 29216
X-Served-By: cache-lga21944-LGA, cache-hhn4080-HHN
Access-Control-Allow-Origin: *, *
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
X-Timer: S1647606779.464353,VS0,VE0
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish, 1.1 varnish
Expires: Fri, 24 Feb 2023 08:58:29 GMT
Cache-Control: max-age=31536000
Accept-Ranges: bytes
X-Cache-Hits: 48360, 412038

GET
H3 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame AD07 13 KB
5 KB 9ms
8ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4980
x-xss-protection: 0
date: Thu, 17 Mar 2022 19:52:10 GMT
expires: Fri, 18 Mar 2022 19:52:10 GMT
cache-control: public, max-age=86400
age: 60049
etag: 12223946614886178233
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js Show response
pagead2.googlesyndication.com/bg/ Frame C063 35 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1aea2369edc419847873c9ce637400269e8dfc7c8c637a8c0bc20c63f977bcbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 22:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 310655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13802
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 22:15:24 GMT

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9D00 78 KB
29 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f8da664ba8dbaf4d8c3308d2d6953ed419107e8e8e7203ec3c911ff645092a84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29949
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431478962109"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:59 GMT

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 9D00 0
837 B 98ms
71ms Ping
text/html 185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QL7CvBMewUAAAMA1gAFAQj799GRBhCtguap8-T2twcYk-vb_8-toa9HKjYJGohlM4ekhj8RSNPq9Tgdgj8ZAAAAoJmZqT8hSNPq9Tgdgj8pGogJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3ZGdHJDX0hzMlFHVGxOR0pWY1ZQYXZpSXNaNjhzUExmemFnTHJXbnUzazlmSWJudWJrelFSSWNQbFlNYmJ4YUppZmtobEtYcE5mTDgwVWZSZWk5M1ZMLWVVTWJuZGt6U1N3TzZVMl9aS3lxUHFIUmJHOEhGeVdVUlU2czc5RWdYOUZFWXZTUHVWVGwzMzZBLTJueE4xekszSDdpNmlHdHVjaFpXX0VicXlKaHh0bkVUVHhWOVFubGVrZk5UVVFlcVkwMHpyV0g2WTZXb0YzcVhFQVBwM3YwdkpMQzhoeDZGMGVUOUhtM3BLejRlTWdKNmVrWk1SdGczOWh1d2JFSWh2VlZ4OTAzVHNCek5oVXptdnUwRjZWWmJDcEJqTFFWaGlfUnItdl8yNkNYbnVYcEd6bFJqVms0ZWloa091Nl9zNGxiZVJGJTI1MjZzYWklMjUzREFNZmwtWVRqX2Z2S0FEYVVWZTlVSVBiazBjSEtjcEhFWTNPWXNzMFhLdl90Rk1DNkNGbU5OOGFYUVpGZlFFUVJuLW5Qa0hIbWlHWTFId3d6Nmd0WFdjbEdCOXF6Q3VDSjBoQUF0ZmJDWU5pVjNDZGpNZndLejNlaGh5aTBGUW5JV0t3JTI1MjZzaWclMjUzRENnMEFyS0pTekdlTDFSTjNwaUVPRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGWmDovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPpAQq_AREsYHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24FPAkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQnJPQWpRSUtYZkZxMkhiMFJZUXhtcm13dXVKWThlZlhNdF9IcVBYVjdmRENvNGlHN0JfTV9hZnFtSWF4YjB5Rl8wZUZqeUNvUDNUa3Mzd2s0alRHeElfTjB4ZEEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSNTM1ODg3ODQyMTIzNTQ2OTI1Igg3NzIyMTc5MyoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQMMTkzLjI3LjE0LjI0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYChxtPHnd3LR8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBeikO_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAEzLgEAmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMzE1NzQ3MTkwN7oHDx2zKL8GQADIBwDSBw0JEUkBRQjaBwYJJUTgBwDqBwIIAPAH5MIBiggCEAA.&s=564aacd6bb8d8ac61ecd73665b5c2f24c7242035&type=nv&nvt=5&jm=1003&px=0&py=0&bw=300&bh=250&sid=1887052701895605531&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=300&ph=250&ww=300&wh=250&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:59 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6c3ced09-cc0b-4513-9d92-fc93552a7ca9
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://ams1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame AD07 78 KB
30 KB 56ms
56ms XHR
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a1f84ce7a642a2b5340fd1ed846e3a6847ede2bf5c0c98cdce86b437f74a0f04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31155
x-xss-protection: 0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 0460 0
729 B 23ms
23ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:59 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5b8b8b01-54a5-49fa-9e53-6a72dbbd794f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/ Frame AD07 25 KB
9 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a18b0faf6a447454e134730303202f8416b72f1d4f744b1d3b4646636240eb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:31:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9657
x-xss-protection: 0
server: cafe
etag: 16576748017229546422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 12:31:30 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame AD07 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd54241a6ef534d4fd55a95d52035292958c4a55c350f8bb38b396ef4f49c1e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:28:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 279
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1235
x-xss-protection: 0
server: cafe
etag: 218260476562286327
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 12:28:20 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AD07 117 KB
36 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc68a3e6e6f0074ff46c18beea2033fc4e8c6ee513dc0617758f45e2bdd8b88a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:32:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36344
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1647431472276194"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame AD07 18 KB
7 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

358cfc8eb339a8ee01040ab6926f11d3c8dd16f43a93764639e7e89f5a1923f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:30:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 129
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7502
x-xss-protection: 0
server: cafe
etag: 16841233975859622389
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 12:30:50 GMT

GET
H3 200 one_click_handler_one_afma.js Show response
tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/ Frame AD07 38 KB
14 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220316/r20110914/client/one_click_handler_one_afma.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

795de749464547ee049fa83f6c514c43d9ce84cd9c835116fe3e5cebc4f3e80d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 11:09:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5021
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14573
x-xss-protection: 0
server: cafe
etag: 13306822095983865851
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Apr 2022 11:09:18 GMT

GET
H3 200 13516702752970834753
tpc.googlesyndication.com/simgad/ Frame AD07 47 KB
47 KB 9ms
9ms Image
image/png 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13516702752970834753?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmLe6Onq5TKmxjROZUb8YcWAXMTmA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf6e8c1e87a527d833f92e2a0cb962553acbe412126947ab83fde356e2aead8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Thu, 17 Mar 2022 11:25:58 GMT
x-content-type-options: nosniff
age: 90421
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48021
x-xss-protection: 0
last-modified: Fri, 19 Nov 2021 06:56:25 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 17 Mar 2023 11:25:58 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame AD07 0
17 B 57ms
56ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C1KuG-3s0Ys6FDNuN7_UPtcWh4AnAq46NadPQ9oqAD7_hHhABIOaX1iVglfqogrAHoAHQqLu6AsgBAqgDAcgDyQSqBNYBT9C4_9SEuczqlZ-yNob1EDaCc0KoFp7SN0aLGxEfS4Vkz-j3D9l2j32X6JVDZOFMpj8djPwyCbfC9-CF5MO6UxVRLAOJ_vj55cTAI5nnQNkvMSBV8hu4abbWMOIBX01-PKRTtlj3WdCGhw_0G9mR51cTQpt_iH4FHrlsawRcVmXL9G-rZHTm3oqWW7zo_utrlpT-zWwO9Le6WYyKIe0kLSP8RtcBoTjjErhsgWRhWxBhlswqKfSBBi1wZIN3C_AALB4bGJSQnnJg6vWeU50-QaTVOGuJS8AEo423hvADkgUECAQYAZIFBAgFGASgBgKAB726i88BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHSCAcIgGEQARgA8ggOYmlkZGVyLTMwNTY0NDeACgTICwHYEwzQFQGAFwGyFwgKBggAEgAYAA&sigh=ua_R3gXHrIY&uach_m=[UACH]&pr=10:0.011056&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 18 Mar 2022 12:32:59 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame AD07 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a465bfbee28e25d830c006be193772f0e1a7002086e7d205d36c066022678f4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js Show response
pagead2.googlesyndication.com/bg/ Frame D8DE 35 KB
14 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Guojae3EGYR4c8nOY3QAJp6N_HyMY3qMC8IMY_l3vL8.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1aea2369edc419847873c9ce637400269e8dfc7c8c637a8c0bc20c63f977bcbf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Mon, 14 Mar 2022 22:15:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 310655
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13802
x-xss-protection: 0
last-modified: Mon, 14 Mar 2022 11:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 14 Mar 2023 22:15:24 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 50ms
50ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gpt_2022031401&jk=36213930197001&bg=!YGOlYyfNAAba2mK92to7ACkAdvg8WtzknvNWddi0Xb-1wrcugbm2ivGyX5Vs5lFi2yqDEpSa1J5zmgIAAACLUgAAAAJoAQeZAuMhvUXeopNkjgsHpJOzAbzDgBllDv5f0SAYHmol17GSCWO7JgkgD6KR7WosQ3KWYCCR-vNzdvtyt4zbJX0znn-fE0_lSIyS6YOi9WzXet166mqHMai1pI8VeZh3OF5nYzjaRAXkesaIuELC2Emp_ugsZJLPLa0HggvS7hQmT1lyx0vqgY9d0kWoE7znmbOrpyhnRQS1q08RjZgHWqtLPfWNCmZnNrv-z90dyPlf83NX075RiIiWIQ8tSBBBP1XcsQ13FsGK_CGYDEYUI501YalBtNJHJK4waVTScWE4yxXgB6vXL31zF40zYZbElVB3bILZmy5cMBh_MdtcQNfQ_yc0btn4wXAyyZMxV3xm-PzHUWgTzmwXMrM41LnqDeuu9dDXlyeyQ5W8SkCt4o1oztdYUSrLnfdLaIXsZFQir5KYGOpm9zrZN9XJEOeEgF1NHigg_yhzuA962N5XNHMo_QFMKfuOcKGt-_PWQIm4TR0vxjMztJNS_NN7d-jD3j50kKOa3cGd1QrbWZfqeLgmSno2YOdrWg3Mj6uV7nvl3gmwpfQ7wQK2pjyrKqP8-V2bxyzBFBHstRUsmszgsQAdb4OnJSoQhHZA4G5m6vr1dHyKvIzbGTfDHCqffcAwhW9yGV5_5SJEOynnbu0QXqANlr-yVxoFBdbmzKn3E1VQxceyiIcbTG_i3m1USjUIGft2x3lKDhueYd3mdehNLt1CPCpmGWnxSxeY571SY_8PvpvQvq0rySzvVkYZI5Rv3VfCqk2ePLzhrVEU7RVLtfoXZrnfCI2xInAGA45Q3sHG2tSYl7nWR-BuftnzJsuOOgPhKe_5kb0GAE7AU4nd99N1Iw49uXBZtHqQrq_AyjMUovEjbdMNG3NI84GT2bz1b3mCeZIYCJZSvqF037Jyr5eggVdg3q_52WJiIGzJKhd80dnSBbdm2Z3-lfG1YpnAaEfZ87mDqhYyC3LCSFHi0Z11M-fB3d0y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:32:59 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

request.php Show response
ad.ad-srv.net/ Frame 1BA7
Redirect Chain

https://ad.ad-srv.net/request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3...
https://ad.ad-srv.net/request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3...

5 KB
2 KB

51ms
29ms

Document
text/html

138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.ad-srv.net/request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3D1654862832191768295%26mt_id%3D7515751%26mt_adid%3D234495%26mt_sid%3D5637254%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_cid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2Fc1d2fa44-701d-4e16-987e-cef10ffb94e7%2F%26mt_lp%3Dhttps%253A%2F%2Fwww.kaspersky.de%2F%26redirect%3D&subid=5637254_1654862832191768295&random=1654862832191768295&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&extVar[]=MM_SSP:ruc&extVar[]=MM_DOM_RTB:wheregoes.com&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&documentReferer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&ancestorOrigins=https%3A%2F%2Fwheregoes.com%2Chttps%3A%2F%2Fwheregoes.com&uidRedirect=1
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: bc934ac8892fd9cb4012c2b0aea0c81815b6c61491ea4ee29e81a098b8785f88

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 18 Mar 2022 12:33:00 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
X-NEORY-SubId: 42294700096279901319921011902008
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1764
Connection: close
Content-Type: text/html; charset=utf-8

Redirect headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 18 Mar 2022 12:33:00 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3D1654862832191768295%26mt_id%3D7515751%26mt_adid%3D234495%26mt_sid%3D5637254%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_cid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2Fc1d2fa44-701d-4e16-987e-cef10ffb94e7%2F%26mt_lp%3Dhttps%253A%2F%2Fwww.kaspersky.de%2F%26redirect%3D&subid=5637254_1654862832191768295&random=1654862832191768295&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&extVar[]=MM_SSP:ruc&extVar[]=MM_DOM_RTB:wheregoes.com&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&documentReferer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&ancestorOrigins=https%3A%2F%2Fwheregoes.com%2Chttps%3A%2F%2Fwheregoes.com&uidRedirect=1
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame 799D 49 B
330 B 1097ms
815ms Image
image/gif 103.229.206.241
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=1654862832191768295&node_id=1612&exch_id=9
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.229.206.241 , Singapore, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.304.1 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:01 GMT
Server: MMBD/3.304.1
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: hkg-router-x67, zrh-bidder-x123
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Fri, 18 Mar 2022 12:33:00 GMT

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 799D 43 B
405 B 553ms
26ms Image
image/gif 2.21.141.186
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=9&v2=1654862832191768295&v3=746345&v4=5637254&v5=7515751&mt_nsync=1&no_attr=1
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.186 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-186.deploy.static.akamaitechnologies.com
Software: MT3 4256 109297d master cdg-pixel-x25 config:1.0.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Server: MT3 4256 109297d master cdg-pixel-x25 config:1.0.0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 12:32:59 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 799D 49 B
330 B 1013ms
527ms Image
image/gif 103.229.206.241
MEDIAMATH-INC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=ruc&bid=1654862832191768295&st=5637254&time=1647606779&nodeid=1612
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 103.229.206.241 , Singapore, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software: MMBD/3.304.1 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:01 GMT
Server: MMBD/3.304.1
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: hkg-router-x23, zrh-bidder-x123
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Fri, 18 Mar 2022 12:33:00 GMT

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame CB3E 281 B
554 B 26ms
8ms Document
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "40014-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 18 Mar 2022 12:33:00 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame CB3E 32 KB
10 KB 10ms
10ms Script
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 084b054ff19b85c2e09fbbccb2e0cdf5d5c0455a9559c36cdc8dbd90da8e087c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?&geo=eu&co=de
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=29274
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9539
Expires: Fri, 18 Mar 2022 20:40:54 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 82A6 42 B
64 B 63ms
47ms Fetch
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv8j5_f1i7m4vcla-7UHwEybOnlWsm3go-UZE7mYoIf8UpR0doBt7bxsv7dfDHahSPdpdHoE1RsimFjFW2fKFUsNE_pxxKPtNvoAey97FQEStHvAaix&sig=Cg0ArKJSzL6EK4iIgoY1EAE&id=lidar2&mcvt=1000&p=950,1091,1200,1391&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220316&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=3809685794&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647606778985&rpt=242&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 7E3D 0
833 B 14ms
13ms Ping
text/html 185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&e=wqT_3QKGBugGAwAAAwDWAAUBCPr30ZEGEMqtnIGG1pagIRgAKjYJ1sVtNIC3oD8RVgkWhzO_mj8ZAAAAwB6F6z8hVg0SACkRJMAxAAAA4FG4nj8w9e2zCzjKQUDlHkhlUKGf6SRYmNVSYABoz_hreACAAQGKAQNVU0SSBQbwqpgBrAKgAfoBqAEBsAEAuAEBwAEFyAEC0AEA2AEA4AEA8AEA2AIA4AKf8D_qAihodHRwczovL3doZXJlZ29lcy5jb20vdHJhY2UvMjAyMjE0NDIxMTYvgAMAiAMBkAMAmAMXoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYQEG9CoBX2I9QUtBbWYtQ0JocExYcFdMeWNuaktEeGdUY0IwNzZvR3N4Nm5QQW1JSXFfdGJ5UnNsNkxEdXMzY3VSVm9pWU1oU2JrYk9hMWw5ZlBJQWpMOTVNMnFlS0R5Mzd2X3NLci1palEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMjM5NjAxNDcxNTMzNTAyMjI4MiIINzcyMjE3OTMqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQNL3V0L3YzL3ByZWJpZJgEAKIEDDE5My4yNy4xNC4yNKgEALIEEAgAEAEYrAIg-gEoADAAOAK4BADABADIBADaBAIIAeAEAfAEoZ_pJIgFAZgFAKAFkIzJoNjBx9cewAUAyQUAAAAAAADwP9IFCQkBCgEBcNgFAeAFAfAFzJAl-gUECAAQAJAGAJgGALgGAMEGASE0AADwP9AG7o8B2gYWChAJEhkBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEwNjE1NzE5Mjc5NroHDwFYRBgAIAAwADi_BkAAyAcA0gcNCRFHAUUI2gcGCSVE4AcA6gcCCADwB-TCAYoIAhAA&s=72015a3ce06d6b9c7e545d8de8186f2caf5ea832&type=pv&jm=1003&px=1091&py=950&bw=300&bh=250&sf=1&sid=2073501811706311074&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=23918325&ft=2

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:00 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a3f7455c-bbf1-4af9-80e4-5c1e7f5e4f1a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame CB3E
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEIR6SUQKhiNDZdUmZtAhVpE&google_cver=1

0
239 B

32ms
8ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEIR6SUQKhiNDZdUmZtAhVpE&google_cver=1
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEIR6SUQKhiNDZdUmZtAhVpE&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 451 709414.gif
id.rlcdn.com/ Frame CB3E 0
0 386ms
14ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame CB3E 70 B
265 B 401ms
30ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Requested by: Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame CB3E
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=bRSEpdnbTdiNUaIpFYpjNA&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=bRSEpdnbTdiNUaIpFYpjNA

43 B
556 B

107ms
107ms

Image
image/gif

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=bRSEpdnbTdiNUaIpFYpjNA

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

HTTP/1.1

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: QQ9DZ00PHJ93JF2Y4MMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=bRSEpdnbTdiNUaIpFYpjNA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame CB3E
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OWE4MzVhOWQyZTU3ZTk0Y2YzMjg3ZDQ4NDUxZTdkZGJkYzdhNzZmOA

170 B
243 B

21ms
20ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OWE4MzVhOWQyZTU3ZTk0Y2YzMjg3ZDQ4NDUxZTdkZGJkYzdhNzZmOA

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=OWE4MzVhOWQyZTU3ZTk0Y2YzMjg3ZDQ4NDUxZTdkZGJkYzdhNzZmOA
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame CB3E
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=WDwCOBEIQhqP7sYhIztfkg&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=WDwCOBEIQhqP7sYhIztfkg

43 B
556 B

32ms
32ms

Image
image/gif

54.239.38.253
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=WDwCOBEIQhqP7sYhIztfkg

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

HTTP/1.1

Server

54.239.38.253 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:00 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 25FPCCVA5RA48Y72MC9F
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=WDwCOBEIQhqP7sYhIztfkg
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame CB3E
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBXRUpBRVUtMVItSkdSVQ==

170 B
232 B

22ms
22ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBXRUpBRVUtMVItSkdSVQ==

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDBXRUpBRVUtMVItSkdSVQ==
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

204

v1
ads.yahoo.com/cms/ Frame CB3E
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0WEJAEU-1R-JGRU&sigv=1&esig=2~7d1fdf0a453636df6878ba233c07246fa0b1de40

0
194 B

34ms
7ms

Image
text/plain

2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0WEJAEU-1R-JGRU&sigv=1&esig=2~7d1fdf0a453636df6878ba233c07246fa0b1de40

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/trace/20221442116/

Protocol

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:00 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L0WEJAEU-1R-JGRU&sigv=1&esig=2~7d1fdf0a453636df6878ba233c07246fa0b1de40
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F9A0 42 B
64 B 47ms
47ms Fetch
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsteSQE9aVb6J_UYiy1gOHisKq36qRhGEC29ydjYrhRai7ourxpQvAwROZ_zgs8YTdY-lFS1tZVN3HrYQkc1LoMQ1IXGJ5bJIf9508TJnbzmmogBNWod&sig=Cg0ArKJSzHMXxCH7fCBEEAE&id=lidar2&mcvt=1000&p=666,1091,916,1391&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220316&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=2861055222&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647606778980&rpt=443&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: acdn.adnxs-simple.com
URL: https://acdn.adnxs-simple.com/strikeforce/script.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://dcd9fc34b55bcc1e5a0592de1c7e5668.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 3BB6 42 B
64 B 53ms
53ms Fetch
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuYxTmf-PAC_QXX2zI9SZy1Uzfh6p5KD_YyzsVKDhgCsh3eIfyBGY-gbgv6UOP5zkzp9KUnyk5Ld1Ys1bgmaP_ChxUlCxzgcIMRLdW7wG0JD2QnivU&sig=Cg0ArKJSzF7k7bREM-dVEAE&cid=CAASFeRoLkh7CSTl-vYCT6KV-A6py8-cBw&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220316&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=2938260542&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647606779079&rpt=381&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK vevent
ams1-ib.adnxs.com/ Frame 9D00 0
837 B 17ms
16ms Ping
text/html 185.33.220.145
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ams1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QL7CvBMewUAAAMA1gAFAQj799GRBhCtguap8-T2twcYk-vb_8-toa9HKjYJGohlM4ekhj8RSNPq9Tgdgj8ZAAAAoJmZqT8hSNPq9Tgdgj8pGogJJMgxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKGf6SRYmNVSYABo69yaAXgAgAEBigEDVVNEkgEBBvSCApgBrAKgAfoBqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGIBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZWNsaWNrLm5ldCUyRnBjcyUyRmNsaWNrJTI1M0Z4YWklMjUzREFLQU9qc3ZGdHJDX0hzMlFHVGxOR0pWY1ZQYXZpSXNaNjhzUExmemFnTHJXbnUzazlmSWJudWJrelFSSWNQbFlNYmJ4YUppZmtobEtYcE5mTDgwVWZSZWk5M1ZMLWVVTWJuZGt6U1N3TzZVMl9aS3lxUHFIUmJHOEhGeVdVUlU2czc5RWdYOUZFWXZTUHVWVGwzMzZBLTJueE4xekszSDdpNmlHdHVjaFpXX0VicXlKaHh0bkVUVHhWOVFubGVrZk5UVVFlcVkwMHpyV0g2WTZXb0YzcVhFQVBwM3YwdkpMQzhoeDZGMGVUOUhtM3BLejRlTWdKNmVrWk1SdGczOWh1d2JFSWh2VlZ4OTAzVHNCek5oVXptdnUwRjZWWmJDcEJqTFFWaGlfUnItdl8yNkNYbnVYcEd6bFJqVms0ZWloa091Nl9zNGxiZVJGJTI1MjZzYWklMjUzREFNZmwtWVRqX2Z2S0FEYVVWZTlVSVBiazBjSEtjcEhFWTNPWXNzMFhLdl90Rk1DNkNGbU5OOGFYUVpGZlFFUVJuLW5Qa0hIbWlHWTFId3d6Nmd0WFdjbEdCOXF6Q3VDSjBoQUF0ZmJDWU5pVjNDZGpNZndLejNlaGh5aTBGUW5JV0t3JTI1MjZzaWclMjUzRENnMEFyS0pTekdlTDFSTjNwaUVPRUFFJTI1MjZmYnNfYWVpZCUyNTNEJTI1NUJnd19mYnMNFDA1RCUyNTI2dXJsZml4QT4ERDEFERBhZHVybAUQOPABANgCAOACn_A_6gIWaEGWmDovL3doZXJlZ29lcy5jb20vgAMAiAMBkAMAmAMZoAMBqgPpAQq_AREsYHBhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24FPAkeRC9nZW5fMjA0P2lkPWF3YmlkJgUG9FMBX2I9QUtBbWYtQnJPQWpRSUtYZkZxMkhiMFJZUXhtcm13dXVKWThlZlhNdF9IcVBYVjdmRENvNGlHN0JfTV9hZnFtSWF4YjB5Rl8wZUZqeUNvUDNUa3Mzd2s0alRHeElfTjB4ZEEmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoSNTM1ODg3ODQyMTIzNTQ2OTI1Igg3NzIyMTc5MyoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQMMTkzLjI3LjE0LjI0qAQAsgQMCAAQABgAIAAwADgCuAQAwAQAyAQA2gQCCAHgBADwBKGf6SSIBQGYBQCgBYChxtPHnd3LR8AFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBeikO_oFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAEzLgEAmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHDDEzMzE1NzQ3MTkwN7oHDx2zKL8GQADIBwDSBw0JEUkBRQjaBwYJJUTgBwDqBwIIAPAH5MIBiggCEAA.&s=564aacd6bb8d8ac61ecd73665b5c2f24c7242035&type=pv&jm=1003&px=0&py=0&bw=300&bh=250&sf=1&sid=1887052701895605531&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.145 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ams1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:00 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5733f185-d2c2-47ec-97e1-f58c13492f5e
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://ams1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 0460 0
729 B 19ms
19ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

a104-111-239-217.deploy.static.akamaitechnologies.com

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:00 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 5e218eed-2e06-48cc-9d9c-304af9cc5a8a
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK viewability Show response
ad8.ad-srv.net/ Frame 1BA7 0
150 B 43ms
12ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ad8.ad-srv.net/viewability?s=42294700096279901319921011902008&a=f07261dc&vb=m
Requested by: Host: ad.ad-srv.net
URL: https://ad.ad-srv.net/request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3D1654862832191768295%26mt_id%3D7515751%26mt_adid%3D234495%26mt_sid%3D5637254%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_cid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2Fc1d2fa44-701d-4e16-987e-cef10ffb94e7%2F%26mt_lp%3Dhttps%253A%2F%2Fwww.kaspersky.de%2F%26redirect%3D&subid=5637254_1654862832191768295&random=1654862832191768295&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&extVar[]=MM_SSP:ruc&extVar[]=MM_DOM_RTB:wheregoes.com&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&documentReferer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&ancestorOrigins=https%3A%2F%2Fwheregoes.com%2Chttps%3A%2F%2Fwheregoes.com&uidRedirect=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1

200
OK

request.php Show response
ad.ad-srv.net/ Frame F466
Redirect Chain

https://ad.ad-srv.net/request.php?zone=nmigdcx4avw9&renderingType=html&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&envData=c701257662564cB7KNNJNdhQDQAlRGZ0VwZjVmAE3bGZcHXejTOyxKd5Jnl5aFTtFEkU...
https://ad.ad-srv.net/request.php?zone=nmigdcx4avw9&renderingType=html&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&envData=c701257662564cB7KNNJNdhQDQAlRGZ0VwZjVmAE3bGZcHXejTOyxKd5Jnl5aFTtFEkU...

5 KB
2 KB

60ms
37ms

Document
text/html

138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.ad-srv.net/request.php?zone=nmigdcx4avw9&renderingType=html&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&envData=c701257662564cB7KNNJNdhQDQAlRGZ0VwZjVmAE3bGZcHXejTOyxKd5Jnl5aFTtFEkUzMNJinpXB_ZGYmv8ib8Yg4HFBiRHFKy0C2pmYM9YB18GY1vFAml0CT9v1dvmXtfG1xFVxFXbbfIeTNr&subid=42294700096279901319921011902008&redirectClick=https%3A%2F%2Fad8.ad-srv.net%2Fc%2Fpe91ez30508qq2i%3Ftprde%3D&uidRedirect=1
Requested by: Host: ad.ad-srv.net
URL: https://ad.ad-srv.net/request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3D1654862832191768295%26mt_id%3D7515751%26mt_adid%3D234495%26mt_sid%3D5637254%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_cid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2Fc1d2fa44-701d-4e16-987e-cef10ffb94e7%2F%26mt_lp%3Dhttps%253A%2F%2Fwww.kaspersky.de%2F%26redirect%3D&subid=5637254_1654862832191768295&random=1654862832191768295&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&extVar[]=MM_SSP:ruc&extVar[]=MM_DOM_RTB:wheregoes.com&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&documentReferer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&ancestorOrigins=https%3A%2F%2Fwheregoes.com%2Chttps%3A%2F%2Fwheregoes.com&uidRedirect=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 01f2127e0b4f60a89d63091a784b58605e85ab1286708a72ef84557b6b0912ed

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3D1654862832191768295%26mt_id%3D7515751%26mt_adid%3D234495%26mt_sid%3D5637254%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_cid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2Fc1d2fa44-701d-4e16-987e-cef10ffb94e7%2F%26mt_lp%3Dhttps%253A%2F%2Fwww.kaspersky.de%2F%26redirect%3D&subid=5637254_1654862832191768295&random=1654862832191768295&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&extVar[]=MM_SSP:ruc&extVar[]=MM_DOM_RTB:wheregoes.com&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&documentReferer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&ancestorOrigins=https%3A%2F%2Fwheregoes.com%2Chttps%3A%2F%2Fwheregoes.com&uidRedirect=1

Response headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 18 Mar 2022 12:33:00 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
X-NEORY-SubId: 98801200096282101649445011902008
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1567
Connection: close
Content-Type: text/html; charset=utf-8

Redirect headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Fri, 18 Mar 2022 12:33:00 +0100
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=nmigdcx4avw9&renderingType=html&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&envData=c701257662564cB7KNNJNdhQDQAlRGZ0VwZjVmAE3bGZcHXejTOyxKd5Jnl5aFTtFEkUzMNJinpXB_ZGYmv8ib8Yg4HFBiRHFKy0C2pmYM9YB18GY1vFAml0CT9v1dvmXtfG1xFVxFXbbfIeTNr&subid=42294700096279901319921011902008&redirectClick=https%3A%2F%2Fad8.ad-srv.net%2Fc%2Fpe91ez30508qq2i%3Ftprde%3D&uidRedirect=1
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 1BA7 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK addDoubleBorder.js Show response
cdn.contentspread.net/cynamics/tools/js/ Frame 1BA7 851 B
1 KB 63ms
11ms Script
application/javascript 88.99.65.215
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.contentspread.net/cynamics/tools/js/addDoubleBorder.js
Requested by: Host: ad.ad-srv.net
URL: https://ad.ad-srv.net/request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3D1654862832191768295%26mt_id%3D7515751%26mt_adid%3D234495%26mt_sid%3D5637254%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_cid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2Fc1d2fa44-701d-4e16-987e-cef10ffb94e7%2F%26mt_lp%3Dhttps%253A%2F%2Fwww.kaspersky.de%2F%26redirect%3D&subid=5637254_1654862832191768295&random=1654862832191768295&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&extVar[]=MM_SSP:ruc&extVar[]=MM_DOM_RTB:wheregoes.com&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&documentReferer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&ancestorOrigins=https%3A%2F%2Fwheregoes.com%2Chttps%3A%2F%2Fwheregoes.com&uidRedirect=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.65.215 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.215.65.99.88.clients.your-server.de
Software: nginx /
Resource Hash: abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Last-Modified: Tue, 03 May 2016 20:55:13 GMT
Server: nginx
ETag: "57291031-353"
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 851

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 97 KB
31 KB 65ms
30ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ff6956c6d9b77bdecabeef7eafb5625c810cf5694db1204d0a48e102ecd73c89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:00 GMT
content-encoding: gzip
last-modified: Tue, 08 Mar 2022 02:42:25 GMT
server: nginx
etag: W/"6226c291-1834f"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Mar 2022 12:33:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AD07 42 B
64 B 51ms
51ms Fetch
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvb4qwVhWLBC-IkT0yz5yTmW-Mm_55Tk9WndjevMsjhKaNBP9E3WM-AFzq8DRDYmLJHeb1-KDqiOX2woNdP7GgUy0iptfIx0V-ltUcwdG_guirlilM&sig=Cg0ArKJSzJ6KISuENVz2EAE&cid=CAASFeRoBwETnc0MOPKr5TBr2SVQlbBDlQ&id=lidar2&mcvt=1000&p=0,0,250,300&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220316&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=2938260542&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647606779463&rpt=255&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 729D 13 KB
5 KB 18ms
17ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

ea26c78f630f8d3924b66a3966e9d96b6ce9217ee085f6db77fa191e13a59848

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

cache-control: private, max-age=3600
content-type: text/html; charset=utf-8
content-encoding: gzip
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
server-processing-duration-in-ticks: 1994
date: Fri, 18 Mar 2022 12:32:59 GMT
content-length: 5147
strict-transport-security: max-age=31536000; preload;

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 97 KB
31 KB 60ms
28ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

ff6956c6d9b77bdecabeef7eafb5625c810cf5694db1204d0a48e102ecd73c89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:00 GMT
content-encoding: gzip
last-modified: Tue, 08 Mar 2022 02:42:25 GMT
server: nginx
etag: W/"6226c291-1834f"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 19 Mar 2022 12:33:00 GMT

GET
H2

200

evergreen-kis-728x90.jpg
media.kaspersky.com/de/affiliates/ Frame F466
Redirect Chain

https://www.awin1.com/cshow.php?s=2519508&v=14098&q=379082&r=559379&pv=0&pref1=98801200096282101649445011902008
https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg

62 KB
62 KB

425ms
56ms

Image
image/jpeg

185.85.15.31
KL-EXT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg

Requested by

Host: ad.ad-srv.net
URL: https://ad.ad-srv.net/request.php?zone=nmigdcx4avw9&renderingType=html&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&envData=c701257662564cB7KNNJNdhQDQAlRGZ0VwZjVmAE3bGZcHXejTOyxKd5Jnl5aFTtFEkUzMNJinpXB_ZGYmv8ib8Yg4HFBiRHFKy0C2pmYM9YB18GY1vFAml0CT9v1dvmXtfG1xFVxFXbbfIeTNr&subid=42294700096279901319921011902008&redirectClick=https%3A%2F%2Fad8.ad-srv.net%2Fc%2Fpe91ez30508qq2i%3Ftprde%3D&uidRedirect=1

Protocol

Server

185.85.15.31 , Germany, ASN200107 (KL-EXT, CH),

Reverse DNS

Software

/ Kaspersky Labs, Kaspersky Labs

Resource Hash

1eeaa9afd461c6df55ffad40e5b003b9f2303727cc0276e677cf61bf9023284a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Tue, 14 Sep 2021 12:09:22 GMT
server
x-powered-by: Kaspersky Labs, Kaspersky Labs
etag: "8ece3b5a61a9d71:0"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
x-xss-protection: 1; mode=block
x-server: fr2/KLM6
accept-ranges: bytes
content-length: 63391
date: Fri, 18 Mar 2022 12:32:59 GMT

Redirect headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Location: https://media.kaspersky.com/de/affiliates/evergreen-kis-728x90.jpg
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK viewability Show response
ad8.ad-srv.net/ Frame F466 0
150 B 37ms
13ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ad8.ad-srv.net/viewability?s=98801200096282101649445011902008&a=635391fb&vb=m
Requested by: Host: ad.ad-srv.net
URL: https://ad.ad-srv.net/request.php?zone=nmigdcx4avw9&renderingType=html&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&envData=c701257662564cB7KNNJNdhQDQAlRGZ0VwZjVmAE3bGZcHXejTOyxKd5Jnl5aFTtFEkUzMNJinpXB_ZGYmv8ib8Yg4HFBiRHFKy0C2pmYM9YB18GY1vFAml0CT9v1dvmXtfG1xFVxFXbbfIeTNr&subid=42294700096279901319921011902008&redirectClick=https%3A%2F%2Fad8.ad-srv.net%2Fc%2Fpe91ez30508qq2i%3Ftprde%3D&uidRedirect=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK cshow.php Show response
www.awin1.com/ Frame 6006 43 B
702 B 118ms
44ms Document
image/gif 104.111.239.217
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.awin1.com/cshow.php?s=2519508&v=14098&q=379082&r=559379&pv=1&pref1=98801200096282101649445011902008

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.111.239.217 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/

Response headers

Content-Type: image/gif
Content-Length: 43
Expires: 0
Pragma: no-cache
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Date: Fri, 18 Mar 2022 12:33:00 GMT
Connection: keep-alive
Strict-Transport-Security: max-age=86400
Awin-Akamai-Rule-Set: default

GET
DATA 200
OK truncated
/ Frame F466 43 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK addDoubleBorder.js Show response
cdn.contentspread.net/hofe/tools/js/ Frame F466 851 B
1 KB 51ms
12ms Script
application/javascript 88.99.65.215
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.contentspread.net/hofe/tools/js/addDoubleBorder.js
Requested by: Host: ad.ad-srv.net
URL: https://ad.ad-srv.net/request.php?zone=nmigdcx4avw9&renderingType=html&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&envData=c701257662564cB7KNNJNdhQDQAlRGZ0VwZjVmAE3bGZcHXejTOyxKd5Jnl5aFTtFEkUzMNJinpXB_ZGYmv8ib8Yg4HFBiRHFKy0C2pmYM9YB18GY1vFAml0CT9v1dvmXtfG1xFVxFXbbfIeTNr&subid=42294700096279901319921011902008&redirectClick=https%3A%2F%2Fad8.ad-srv.net%2Fc%2Fpe91ez30508qq2i%3Ftprde%3D&uidRedirect=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.65.215 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.215.65.99.88.clients.your-server.de
Software: nginx /
Resource Hash: abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:00 GMT
Last-Modified: Fri, 05 Aug 2016 12:57:29 GMT
Server: nginx
ETag: "57a48d39-353"
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 851

GET
H2

200

sid Show response
mug.criteo.com/ Frame 729D
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=PGQHgHxIdVQ0MUtLYjU0WWNiNEIzejhKMno2cDF0RlkzaGRHNXU5M2V2ZFh6U1hrRDhIaTdodmk3b1hUTGdUaDVxVm9EY1B0NVltNFhXcm5RS0xIeDkrM1Y0WFdTZGkydlNJbE0xY1dIQW1jZzIyL1U3ZDErZHdMQUIwVV...

430 B
631 B

173ms
15ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=PGQHgHxIdVQ0MUtLYjU0WWNiNEIzejhKMno2cDF0RlkzaGRHNXU5M2V2ZFh6U1hrRDhIaTdodmk3b1hUTGdUaDVxVm9EY1B0NVltNFhXcm5RS0xIeDkrM1Y0WFdTZGkydlNJbE0xY1dIQW1jZzIyL1U3ZDErZHdMQUIwVVdDR0pjbzB4V0Vlc1M3NnFzK3EwN1ZQRE0yc1Zob0MzOEJKd01LMTBxQnZSV0N6ZjdOWXR1TkhTL3FaM21DUVA0WXliTFpxeEtqK0hNMW9DVGlUSmJKeWV2MEJQTldrR1ZLdmhHVkFZVWh4ZFBBNEF1WTdNRkVkNW1zOGN2MmhrOWVYS0llenlxRkVLM0tMU1N1VXNpbHNDcWd3S3dQQT09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

e57c620a2c03cff279176c7f070a3a1d4227b7fd2edf16d660f99602a0a45475

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:00 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3945
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:32:59 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=PGQHgHxIdVQ0MUtLYjU0WWNiNEIzejhKMno2cDF0RlkzaGRHNXU5M2V2ZFh6U1hrRDhIaTdodmk3b1hUTGdUaDVxVm9EY1B0NVltNFhXcm5RS0xIeDkrM1Y0WFdTZGkydlNJbE0xY1dIQW1jZzIyL1U3ZDErZHdMQUIwVVdDR0pjbzB4V0Vlc1M3NnFzK3EwN1ZQRE0yc1Zob0MzOEJKd01LMTBxQnZSV0N6ZjdOWXR1TkhTL3FaM21DUVA0WXliTFpxeEtqK0hNMW9DVGlUSmJKeWV2MEJQTldrR1ZLdmhHVkFZVWh4ZFBBNEF1WTdNRkVkNW1zOGN2MmhrOWVYS0llenlxRkVLM0tMU1N1VXNpbHNDcWd3S3dQQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1852
content-length: 541
expires: 0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 08BB 0
0 53ms
53ms Fetch
image/gif 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvEgZ7n0csFrWuZ597kv6owFS6KFaowCv1wiyycSVZsH7PhMLmwNDrKOgqTVAws3Rp0MnSZERk1SoIytu0llDmM2qKPQuNJIqX45s5ZC476zOjz2o_SHXSD_BvpICH--GCz0Q3d6c3f1XJ-GeZ6sgGfnozZ-GCk-g8PVNBC9WPbmsDnUxSBqYSPUJHF3P347pWmqhgpyGAoJiWW8cQmuM6meDPmdxTkeaPcW5HtmKP9zPa-1S6JuQ6zgI0gLiagT0oszk5TnF-Ad5mbG3typ4LRIdK4qBwOAvBzBBIICtZz6wPAdoWgqPfLVipOi7qkNytUiIn0ABFzM2krB-GZTg&sai=AMfl-YSbGQcC7Kr8CE9T3_coPtaxb86kZHoY3tpdFYXFlbIS1JS7kp6iQzgWdoDRYFDxtZWESkPTyflhY0THpVZbLd77MheGaRYzsSxvFxaMD7zbb7Odw9Cz9M66-By_k7M&sig=Cg0ArKJSzINNkEGW1T8WEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 18 Mar 2022 12:33:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 18 Mar 2022 12:33:01 GMT

GET
H/1.1 200
OK viewability Show response
ad8.ad-srv.net/ Frame 1BA7 0
150 B 34ms
12ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ad8.ad-srv.net/viewability?s=42294700096279901319921011902008&a=f07261dc&vb=v
Requested by: Host: ad.ad-srv.net
URL: https://ad.ad-srv.net/request.php?zone=8wexqd9dxefc&renderingType=html&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3D67f05722de24e449cedc917eb5c1953f34a808ad_2%26mt_aid%3D1654862832191768295%26mt_id%3D7515751%26mt_adid%3D234495%26mt_sid%3D5637254%26mt_exid%3D9%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_cid%3D38c76234-7bfb-4b01-ae5d-d9c052df8354%26mt_3pck%3Dhttps%253A%2F%2Fbeacon-nf.rubiconproject.com%2Fbeacon%2Fv2%2Ft%2F0%2Fc1d2fa44-701d-4e16-987e-cef10ffb94e7%2F%26mt_lp%3Dhttps%253A%2F%2Fwww.kaspersky.de%2F%26redirect%3D&subid=5637254_1654862832191768295&random=1654862832191768295&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&extVar[]=MM_SSP:ruc&extVar[]=MM_DOM_RTB:wheregoes.com&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&documentReferer=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F&ancestorOrigins=https%3A%2F%2Fwheregoes.com%2Chttps%3A%2F%2Fwheregoes.com&uidRedirect=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:01 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 iframe Show response
mantodea.mantisadnetwork.com/prebid/ Frame 51C4 258 B
495 B 98ms
98ms Document
text/html 3.214.91.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1647606778513&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.214.91.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-91-80.compute-1.amazonaws.com
Software: / Express
Resource Hash: cb8223f111e367f49b7019c6cf9a53e2c6c9452173430bccb0d418716c51ac75

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

date: Fri, 18 Mar 2022 12:33:01 GMT
content-type: text/html; charset=utf-8
content-length: 258
x-powered-by: Express
vary: Origin
access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
pragma: no-cache
expires: -1
etag: W/"102-CBNc/zjNheMos7etqW45cPnlvVs"

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame B5E4 52 KB
17 KB 23ms
23ms Document
text/html 104.108.144.200
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.144.200 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-144-200.deploy.static.akamaitechnologies.com
Software: nginx/1.13.10 /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

Last-Modified: Wed, 02 Dec 2020 20:56:47 GMT
ETag: "5fc7ff8f-cf34"
Server: nginx/1.13.10
Content-Type: text/html
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Content-Length: 17053
Cache-Control: max-age=86402
Expires: Sat, 19 Mar 2022 12:33:03 GMT
Date: Fri, 18 Mar 2022 12:33:01 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame F90A 2 KB
814 B 8ms
8ms Document
text/html 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1647606778215

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

a104-107-160-24.deploy.static.akamaitechnologies.com

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 90E9 281 B
554 B 7ms
7ms Document
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "40014-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 18 Mar 2022 12:33:01 GMT
Connection: keep-alive
Vary: Accept-Encoding

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame 91B3 23 KB
8 KB 80ms
29ms Document
text/html 104.107.160.24
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2030%2C273%2C233%2C2028%2C2027%2C236%2C237%2C2025%2C117%2C97%2C99%2C55%2C3012%2C3011%2C3010%2C3007%2C201%2C4%2C246%2C203%2C9%2C2011%2C3022%2C3020%2C172%2C173%2C251%2C175%2C2009%2C255%2C178%2C3018%2C3017%2C214%2C3014%2C338%2C70%2C77%2C38%2C182%2C261%2C141%2C222%2C301%2C225%2C80%2C10000%2C229%2C108%2C307&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1&itype=PREBID

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.107.160.24 Berlin, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

1b46304fd8b0f479ceb597b36a8a086f2268ef7ef95c50ced939301e70ca330b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

server: Apache
content-type: text/html; charset=UTF-8
x-mnet-hl2: E
strict-transport-security: max-age=604800
vary: Accept-Encoding
content-encoding: gzip
cache-control: max-age=172800
expires: Sun, 20 Mar 2022 12:33:01 GMT
date: Fri, 18 Mar 2022 12:33:01 GMT
content-length: 8246

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 10D1 8 KB
4 KB 154ms
24ms Document
text/html 2620:1ec:29::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:29::45 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0849eef021b381cb3f64d424bdd29839513dbb4e964aef0420136906426a18de

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

cache-control: max-age=86400
content-type: text/html
content-encoding: br
last-modified: Tue, 15 Mar 2022 23:39:48 GMT
accept-ranges: bytes
etag: "866b66bb3ccc5c8de41913672c69b8f7"
x-cache: TCP_HIT
server: AmazonS3
x-amz-id-2: ijj6zWwmxEoqUg2YmCo9s3ArQ0uIEHR4d/pID85s/aeCkpHntsnAH6uTNppkx0IzZSAjVpOC1tM=
x-amz-request-id: PF5WFTJWYCTJG4J6
x-amz-meta-codebuild-content-sha256: 1bd3623b950dcf081744ebf0150c6ff72edcc5cbd4a3ea8293d7f9c29b2e9c0b
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:a4519585-d31b-4588-8499-6641ec459b43
x-amz-meta-codebuild-content-md5: d97b029b026ab1b5da9f71fc8f6cf19a
x-azure-ref: 0/Xs0YgAAAAC6Ugafn0ljRbq+N9HVH5ACTE9OMjFFREdFMDIxMAA4NGU3ZGZhMi0xNDQyLTQzMzQtYjM0Zi1lNDJkM2Y3ZGRhZDk=
date: Fri, 18 Mar 2022 12:33:01 GMT

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame 0347 0
0 151ms
151ms Document
text/plain 63.251.14.14
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=8128488
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1647606600000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.14.14 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/

Response headers

Date: Fri, 18 Mar 2022 12:33:01 GMT
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Pragma: no-cache
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
X-Sovrn-Pod: ad_ap1sea1

GET
H2 204 /
onetag-sys.com/usync/ 0
52 B 7ms
7ms Image
text/plain 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-cache, no-transform

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 90E9 32 KB
10 KB 8ms
8ms Script
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 084b054ff19b85c2e09fbbccb2e0cdf5d5c0455a9559c36cdc8dbd90da8e087c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:01 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=29273
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9539
Expires: Fri, 18 Mar 2022 20:40:54 GMT

GET
H/1.1 200
OK viewability Show response
ad8.ad-srv.net/ Frame F466 0
150 B 33ms
12ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ad8.ad-srv.net/viewability?s=98801200096282101649445011902008&a=635391fb&vb=v
Requested by: Host: ad.ad-srv.net
URL: https://ad.ad-srv.net/request.php?zone=nmigdcx4avw9&renderingType=html&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&envData=c701257662564cB7KNNJNdhQDQAlRGZ0VwZjVmAE3bGZcHXejTOyxKd5Jnl5aFTtFEkUzMNJinpXB_ZGYmv8ib8Yg4HFBiRHFKy0C2pmYM9YB18GY1vFAml0CT9v1dvmXtfG1xFVxFXbbfIeTNr&subid=42294700096279901319921011902008&redirectClick=https%3A%2F%2Fad8.ad-srv.net%2Fc%2Fpe91ez30508qq2i%3Ftprde%3D&uidRedirect=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 Reilingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ad.ad-srv.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:01 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame B5E4 0
729 B 25ms
25ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:01 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2a8cf51d-66b3-46d3-b428-69358abf4615
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 fltiu.js Show response
pixel.yabidos.com/ Frame 51C4 2 KB
1 KB 62ms
26ms Script
application/javascript 104.16.200.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1647606778513&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.200.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04e15c27c7c1e344842fec61d78bfb338739501f6d293a013d57a808efcc3674

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:44 GMT
server: cloudflare
age: 6379
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6eddfe938e390487-CDG
content-length: 1168
expires: Fri, 18 Mar 2022 14:33:02 GMT

GET
H2

200

query
ecs.mantisadnetwork.com/sync/pixel/ Frame 51C4
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=rjrqv8k&ttd_tpi=1
https://match.adsrvr.org/track/cmb/generic?ttd_pid=rjrqv8k&ttd_tpi=1
https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=415681b5-feef-403e-8676-1b40a94b0535

35 B
152 B

135ms
104ms

Image
image/gif

3.214.91.80
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=415681b5-feef-403e-8676-1b40a94b0535
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1647606778513&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F
Protocol: H2
Server: 3.214.91.80 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-214-91-80.compute-1.amazonaws.com
Software: / Express
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
x-powered-by: Express
etag: W/"23-X71HIiL+uKIs9biqXcW44Tr4jis"
content-length: 35
content-type: image/gif

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://ecs.mantisadnetwork.com/sync/pixel/query?source=tradedesk&id=415681b5-feef-403e-8676-1b40a94b0535
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 241

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame B504 4 KB
2 KB 97ms
29ms Document
text/html 18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c2870ae67359c64a250f8eaa7d6009b810ca2506956e1a33ed5087c6542bf758

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-type: text/html;charset=UTF-8
server: nginx
etag: W/"034665b0be64bb7ec28b0349070b9d114"
timing-allow-origin: *
content-encoding: gzip

GET
H2 204 ps
pixel.33across.com/ Frame B8AA 0
0 349ms
118ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.33across.com/ps?m=xch&rt=html&id=0010b00002Mq2FYAAZ&ru=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D304%26uid%3D33XUSERID33X
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP005 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

x-33x-status: 2000208
server: 33XP005
date: Fri, 18 Mar 2022 12:33:02 GMT

GET
H2 200 / Show response
onetag-sys.com/usync/ Frame DC3E 2 KB
814 B 10ms
7ms Document
text/html 51.38.120.206
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.38.120.206 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

37a31642af0a7fe695ed0fd68a06a55af44e854d083dc7f5d0e70535f0189ae0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

content-type: text/html
cache-control: no-transform, no-cache
content-encoding: gzip
content-length: 731
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame B14C 868 B
1 KB 399ms
71ms Document
text/html 185.86.139.104
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: ac4819df2f4e71293bcc1c3beb4e3834550fa080c4846f309baea26143aa7aac

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

content-length: 868
content-type: text/html
date: Fri, 18 Mar 2022 12:33:02 GMT

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame B9BC
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
3 KB

23ms
23ms

Document
text/html

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7c74f91a09bf3ff0b4d1219900bfc46b12672e4d7999e090e0a9dc2744da47d1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/

Response headers

Server: Apache
Content-Type: text/html
Dropped-Udsids: 241|230|39|45|81|73|156|188
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Vary: Is-Traffic-Usersync
Expires: Fri, 18 Mar 2022 12:33:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
Content-Length: 1606
Connection: keep-alive

Redirect headers

Server: Apache
Content-Length: 311
Content-Type: text/html; charset=iso-8859-1
Location: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Expires: Fri, 18 Mar 2022 12:33:02 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
Connection: keep-alive

GET
H2

200

sync
ads.servenobid.com/ Frame 10D1
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=5142694527701022099

0
343 B

30ms
30ms

Image
image/avif

54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=5142694527701022099
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 731.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 54319a21-2d69-4ac8-8d25-33f5d899b11f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=5142694527701022099
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 10D1
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=22d1fb348b6887527fa7e1a6

0
347 B

31ms
31ms

Image
image/avif

54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=22d1fb348b6887527fa7e1a6
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=22d1fb348b6887527fa7e1a6
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap2sea1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 10D1 0
277 B 154ms
152ms Image
text/plain 63.251.14.14
INTERNAP-BLOCK-4

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 63.251.14.14 , United States, ASN14744 (INTERNAP-BLOCK-4, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 18 Mar 2022 12:33:02 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap1sea1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2

200

usersync
rtb.gumgum.com/ Frame 10D1
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1647606782074
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=7627145257
https://sync.1rx.io/usersync/tradedesk/415681b5-feef-403e-8676-1b40a94b0535
https://sync.targeting.unrulymedia.com/csync/RX-bec1049d-2c1d-46d8-8418-2079be285fbc-003?redir=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3DRX-bec1049d-2c1d-46d8-8418-2079be285fbc-003
https://rtb.gumgum.com/usersync?b=rhy&i=RX-bec1049d-2c1d-46d8-8418-2079be285fbc-003

35 B
208 B

35ms
35ms

Image
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=rhy&i=RX-bec1049d-2c1d-46d8-8418-2079be285fbc-003
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

location: https://rtb.gumgum.com/usersync?b=rhy&i=RX-bec1049d-2c1d-46d8-8418-2079be285fbc-003
date: Fri, 18 Mar 2022 12:33:02 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXbec1049d2c1d46d884182079be285fbc003
content-type: text/html

GET
H2

200

sync
ads.servenobid.com/ Frame 10D1
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5107433822913037941

0
344 B

30ms
30ms

Image
image/avif

54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5107433822913037941
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5107433822913037941
Date: Fri, 18 Mar 2022 12:33:02 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usa
sync.go.sonobi.com/ Frame 10D1 0
478 B 56ms
13ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 10D1
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=0f1e5311-79fb-4b68-b308-40becc1762fe&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
356 B

31ms
31ms

Image
image/avif

54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=0f1e5311-79fb-4b68-b308-40becc1762fe&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=0f1e5311-79fb-4b68-b308-40becc1762fe&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Fri, 18 Mar 2022 12:33:01 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 1
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 10D1
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
https://ads.servenobid.com/sync?pid=337&uid=y-wMUehOtE2uGJ_mL82R_SYb9U0X5mwi.BlBro0.8-~A

0
366 B

33ms
33ms

Image
image/avif

54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-wMUehOtE2uGJ_mL82R_SYb9U0X5mwi.BlBro0.8-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-wMUehOtE2uGJ_mL82R_SYb9U0X5mwi.BlBro0.8-~A
date: Fri, 18 Mar 2022 12:33:02 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 flimpobj.js Show response
pixel.yabidos.com/ Frame 51C4 31 KB
24 KB 23ms
23ms Script
application/javascript 104.16.200.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/flimpobj.js?cb=1647606782032&ver1=2.2.3&qid=83233313f553333313f513430313&rnd=hnhnpzbyk937&cid=1041
Requested by: Host: pixel.yabidos.com
URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.200.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cf0498d6f16d928751dae8b235dab5e250f65d561f43e2dc20d982efac6016f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:44 GMT
server: cloudflare
age: 25
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6eddfe93ce6f0487-CDG
content-length: 24217
expires: Fri, 18 Mar 2022 14:33:02 GMT

GET
H2 200 vbl.gif
pre.glotgrx.com/ Frame 51C4 26 B
88 B 61ms
23ms Image
image/gif 2606:4700::6810:78c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/vbl.gif?cb=1647606782085&rnd=hnhnpzbyk937&ifm=1&uai=1&cid=1041&s=wheregoes.com&p=undefined&x=&adtg=&ats=0&atf=&nsi=&si=&nci=&nai=&pft=0&iip=0&adb=1&adc=0&adcd=i0_f0_o0_e0&ai=&icp=undefined&impid=&idl=&ttduid=&id5=&emh=
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1647606778513&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:78c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:33 GMT
server: cloudflare
age: 2069
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6eddfe9479040215-ZRH
content-length: 26
expires: Fri, 18 Mar 2022 14:33:02 GMT

GET
H2 200 nflrc.gif
pre.glotgrx.com/ Frame 51C4 26 B
303 B 60ms
21ms Image
image/gif 2606:4700::6810:78c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/nflrc.gif?cb=1647606782075170&ver=1.2r81&qid=83233313f553333313f513430313&p=undefined&s=wheregoes.com&x=&cid=1041&od1=&od2=&adtg=&nci=&nai=&si=&ai=&nsi=&co=0&cstm1=&cstm2=&cstm3=&rnd=hnhnpzbyk937&impid=&idl=&ttduid=&id5=&emh=&tps=2&ver1=2.2.3&1=b7fc69a3c700f9fbd813b1e3eb2aeba2&2=0.0&3=1200_1600_1200_1600_24_24_1&5=%7B%220%22%3A%7B%220%22%3A%22Chrome%2520PDF%2520Plugin%2520-%2520%2520-%2520internal-pdf-viewer%2520-%2520Portable%2520Document%2520Formatfl_br%22%2C%221%22%3A%22Chrome%2520PDF%2520Viewer%2520-%2520%2520-%2520mhjfbmdgcfjbbpaeojofohoefgiehjai%2520-%2520fl_br%22%2C%222%22%3A%22Native%2520Client%2520-%2520%2520-%2520internal-nacl-plugin%2520-%2520fl_br%22%7D%7D&6=2&7={%22e%22:%2211%22,%22m%22:%220%22,%22f%22:%223428%22}&ats=0&atf=&dbgcid=1041&ifm=1&penv=b&pt=&ptbp=&tw=0&ldp=1&icpl=26&icp=https%253A//wheregoes.com/&irfl=26&irf=https%253A//wheregoes.com/&cty=4&fcs=0&flky=ver-fl-6-qid-fl-28-p-fl-9-s-fl-13-x-fl-0-cid-fl-4-od1-fl-0-od2-fl-0-adtg-fl-0-nci-fl-0-nai-fl-0-si-fl-0-ai-fl-0-nsi-fl-0-co-fl-0-cstm1-fl-0-cstm2-fl-0-cstm3-fl-0-rnd-fl-12-impid-fl-0-idl-fl-0-ttduid-fl-0-id5-fl-0-emh-fl-0-tps-fl-0-cb-fl-13-ver1-fl-5-&spfp=1&spfnp=0&sp1=Chromefl_andLinux&sp2=Chromefl_andWindows&adv=0&det=1&adb=1&iip=0&spf=0&adc=0&adcd=i0_f0_o0_e0&vps=0x0&gpu=Intel%20Iris%20OpenGL%20Engine&ncf=4g_10_undefined_null_0_undefined_false&chua={%22architecture%22:%22%22,%22brands%22:[],%22mobile%22:false,%22model%22:%22%22,%22platform%22:%22%22,%22platformVersion%22:%22%22,%22uaFullVersion%22:%22%22}&fli=&flerr=0&trim=&fio=38
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1647606778513&secure=true&version=9&title=Trace%20Results%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Ftrace%2F20221442116%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:78c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
cf-cache-status: HIT
last-modified: Sat, 05 Mar 2022 11:39:33 GMT
server: cloudflare
age: 70
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 6eddfe9479090215-ZRH
content-length: 26
expires: Fri, 18 Mar 2022 14:33:02 GMT

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame B9BC
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YjR7_r2fZI52OvL1sxNj4QAABKYAAAAB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YjR7_r2fZI52OvL1sxNj4QAABKYAAAAB&dcc=t

43 B
645 B

103ms
103ms

Image
image/gif

209.54.177.54
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YjR7_r2fZI52OvL1sxNj4QAABKYAAAAB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

209.54.177.54 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 8C3S3Q1FEG1VQQSHXZAH
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: R08GBWZT6W55MYKRCRCQ
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YjR7_r2fZI52OvL1sxNj4QAABKYAAAAB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame B9BC 170 B
188 B 33ms
18ms Image
image/png 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YjR7_r2fZI52OvL1sxNj4QAABKYAAAAB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame B9BC 70 B
264 B 33ms
30ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame B9BC
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YjR7-r2fZI52OvL1sxNj4QAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEDnI8juQRaJkykOENP7sN-c&google_cver=1&gdpr=1

43 B
1001 B

15ms
14ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEDnI8juQRaJkykOENP7sN-c&google_cver=1&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 12:33:02 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESEDnI8juQRaJkykOENP7sN-c&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame B9BC
Redirect Chain

https://pixel.quantserve.com/pixel/p-Z8PuJEk6U7Hyq.gif?idmatch=0&gdpr=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=5BQ17eVEYLz_FTHv4BAr7bMQN-H_EmLutECtdqxf

43 B
1 KB

17ms
17ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=5BQ17eVEYLz_FTHv4BAr7bMQN-H_EmLutECtdqxf
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 18 Mar 2022 12:33:02 GMT

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=81&&external_user_id=5BQ17eVEYLz_FTHv4BAr7bMQN-H_EmLutECtdqxf
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 YjR7_r2fZI52OvL1sxNj4QAABKYAAAAB
pr-bh.ybp.yahoo.com/sync/casale/ Frame B9BC 43 B
989 B 175ms
32ms Image
image/gif 2a05:d018:d29:3605:68cd:a251:4c84:bc1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pr-bh.ybp.yahoo.com/sync/casale/YjR7_r2fZI52OvL1sxNj4QAABKYAAAAB?gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2a05:d018:d29:3605:68cd:a251:4c84:bc1 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

ATS /

Resource Hash

48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
content-type: image/gif
x-xss-protection: 1; mode=block
content-length: 43
x-content-type-options: nosniff

GET
H/1.1 200
OK cookiesync
bttrack.com/pixel/ Frame B9BC 35 B
380 B 384ms
95ms Image
image/gif 192.132.33.46
BIDTELLECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bttrack.com/pixel/cookiesync?source=67e94f23-25d6-4008-8236-375d1743c2e0&secure=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS: 46.bidtellect.com
Software: Microsoft-IIS/8.5 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

X-ServerName: Track001-iad
Pragma: no-cache
Date: Fri, 18 Mar 2022 12:32:56 GMT
X-AspNetMvc-Version: 5.2
Server: Microsoft-IIS/8.5
X-AspNet-Version: 4.0.30319
P3P: CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control: private,no-cache
Content-Type: image/gif
Content-Length: 35
Expires: -1

GET
H2 200 CookieIndex
rtb.adentifi.com/ Frame B9BC 0
47 B 308ms
98ms Image
text/plain 34.228.125.52
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.228.125.52 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-228-125-52.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-length: 0
content-type: text/plain

GET
H2 200 sync
ads.servenobid.com/ Frame B9BC 0
356 B 32ms
30ms Image
image/avif 54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=YjR7_r2fZI52OvL1sxNj4QAABKYAAAAB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame B504
Redirect Chain

https://secure.adnxs.com/getuid?https://rtb.gumgum.com/usersync?b=apn&i=$UID
https://rtb.gumgum.com/usersync?b=apn&i=5142694527701022099

35 B
208 B

43ms
34ms

Image
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=apn&i=5142694527701022099
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2cf60598-3d1d-4028-bb0b-1e67a16b5e1c
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://rtb.gumgum.com/usersync?b=apn&i=5142694527701022099
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

bidswitch
event.clientgear.com/gogocookie/ Frame B504
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_732458a5-f5bb-4f30-b514-86566fd7e3a9&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_732458a5-f5bb-4f30-b514-86566fd7e3a9&gdpr=0&gdpr_consent=&us_privacy=1---
https://event.clientgear.com/cookie/bidswitch?partner=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=f70057e4-38b3-4ce5-b2ab-5a780d291297
https://event.clientgear.com/gogocookie/bidswitch?partner=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=f70057e4-38b3-4ce5-b2ab-5a780d291297

0
37 B

114ms
114ms

Image
text/plain

47.252.78.131
ALIBABA-CN-NET Al...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://event.clientgear.com/gogocookie/bidswitch?partner=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=f70057e4-38b3-4ce5-b2ab-5a780d291297
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 47.252.78.131 , United States, ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-length: 0

Redirect headers

location: http://event.clientgear.com/gogocookie/bidswitch?partner=bidswitch&bidswitch_ssp_id=gumgum2&bsw_custom_parameter=f70057e4-38b3-4ce5-b2ab-5a780d291297
date: Fri, 18 Mar 2022 12:33:02 GMT
content-length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame B504
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobRdUrl%7D
https://rtb.gumgum.com/usersync?b=obn&i=ENC%28Ye2y51Ijn1JptCu4JguAaVxXk_GZNqpZlF6PMZ3CIon3AnZocWNoxD4S2eQgarte%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%26pla...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_732458a5-f5bb-4f30-b514-86566fd7e3a9&obuid=ENC(Ye2y51Ijn1JptCu4JguAaVxXk_GZNqpZlF6PMZ3CIon3AnZocWNoxD4S2eQgarte)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://pixel.advertising.com/ups/58440/sync?&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redir=true
https://pixel.advertising.com/ups/58440/sync?&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redir=true&verify=true
https://ups.analytics.yahoo.com/ups/58440/sync?&gdpr=$GDPR_APPLIES&gdpr_consent=$CONSNT_STRING&redir=true&apid=UP8dd204ef-a6b7-11ec-b735-0688f7483fb0
https://sync.outbrain.com/cookie-sync?p=oath&uid=UP8dd204ef-a6b7-11ec-b735-0688f7483fb0

0
309 B

87ms
87ms

Image
text/plain

64.202.112.191
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=oath&uid=UP8dd204ef-a6b7-11ec-b735-0688f7483fb0
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 64.202.112.191 Leesburg, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:03 GMT
Cache-Control: no-cache
X-TraceId: 97e8c757674974823e2e3056591dab17
Content-Length: 0

Redirect headers

location: https://sync.outbrain.com/cookie-sync?p=oath&uid=UP8dd204ef-a6b7-11ec-b735-0688f7483fb0
date: Fri, 18 Mar 2022 12:33:03 GMT
server: ATS/9.1.0.33
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

usersync
rtb.gumgum.com/ Frame B504
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://rtb.gumgum.com/usersync?b=opx&i=5a47e90d-64d5-47d2-a1ff-40752d8f1447

35 B
208 B

35ms
35ms

Image
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=opx&i=5a47e90d-64d5-47d2-a1ff-40752d8f1447
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-encoding: gzip
server: OXGW/17.2.1
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://rtb.gumgum.com/usersync?b=opx&i=5a47e90d-64d5-47d2-a1ff-40752d8f1447
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H2

200

usersync
rtb.gumgum.com/ Frame B504
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=sta&i=0-d5238855-278a-41d9-4a58-6411d9a3bb45$ip$193.27.14.24

35 B
208 B

35ms
34ms

Image
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=sta&i=0-d5238855-278a-41d9-4a58-6411d9a3bb45$ip$193.27.14.24
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=sta&i=0-d5238855-278a-41d9-4a58-6411d9a3bb45$ip$193.27.14.24
Date: Fri, 18 Mar 2022 12:33:02 GMT
Connection: keep-alive
Content-Length: 121
Content-Type: text/html; charset=utf-8

GET
H2

200

usersync
rtb.gumgum.com/ Frame B504
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=oth&i=y-JHfRRFBE2pd0tdCMr57BVIpRHE06aAjlbRIS~A

35 B
208 B

35ms
35ms

Image
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=oth&i=y-JHfRRFBE2pd0tdCMr57BVIpRHE06aAjlbRIS~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

date: Fri, 18 Mar 2022 12:33:02 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://rtb.gumgum.com/usersync?b=oth&i=y-JHfRRFBE2pd0tdCMr57BVIpRHE06aAjlbRIS~A
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2

200

usersync
rtb.gumgum.com/ Frame B504
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Frtb.gumgum.com%2Fusersync%...
https://rtb.gumgum.com/usersync?b=vnt&i=8d80fecd-a6b7-11ec-a067-9f07980f3cf4

35 B
208 B

35ms
35ms

Image
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=vnt&i=8d80fecd-a6b7-11ec-a067-9f07980f3cf4
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Location: https://rtb.gumgum.com/usersync?b=vnt&i=8d80fecd-a6b7-11ec-a067-9f07980f3cf4
Date: Fri, 18 Mar 2022 12:33:01 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 8d80fece-a6b7-11ec-a067-9f07980f3cf4

GET
H2 204 services
sync.technoratimedia.com/ Frame B504 0
293 B 310ms
96ms Image
text/plain 150.136.26.45
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 150.136.26.45 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
via: 1.1 varnish
server: nginx
age: 0
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 344815929
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true

GET
H2 200 142
match.deepintent.com/usersync/ Frame B504 0
44 B 299ms
96ms Image
text/plain 169.197.150.8
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 169.197.150.8 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS: g.deepintent.com
Software: b /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:01 GMT
content-length: 0
server: b

GET
H2

200

usersync
rtb.gumgum.com/ Frame B504
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_732458a5-f5bb-4f30-b514-86566fd7e3a9&gdpr=0&gdpr_consent=&us_privacy=1---
https://stags.bluekai.com/site/23178?id=f_q7D--iFACmrTdYf4YR&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS64TUMIXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT2ZS7OE3UILJNNFDECQ3NOJKGIWLGGRMVEJTVONPXA...
https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=f_q7D--iFACmrTdYf4YR&us_privacy=1---

35 B
208 B

35ms
35ms

Image
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=f_q7D--iFACmrTdYf4YR&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 18 Mar 2022 12:33:02 GMT
P3p: CP="We do not support P3P header."
Location: https://rtb.gumgum.com/usersync?b=zem&gdpr=0&i=f_q7D--iFACmrTdYf4YR&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 118
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200
OK

usersync
usersync.gumgum.com/ Frame B504
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=ca8637bd-b3f3-48b5-9578-9b9685c06746

35 B
296 B

174ms
35ms

Image
image/gif

54.216.63.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=ca8637bd-b3f3-48b5-9578-9b9685c06746
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 54.216.63.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-63-116.eu-west-1.compute.amazonaws.com
Software: envoy /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:01 GMT
server: envoy
content-type: image/gif
cache-control: private, no-store, must-revalidate, max-age=0
x-envoy-upstream-service-time: 5
x-region: ireland
content-length: 35
expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=ca8637bd-b3f3-48b5-9578-9b9685c06746
date: Fri, 18 Mar 2022 12:33:02 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

RX-bec1049d-2c1d-46d8-8418-2079be285fbc-003
sync.targeting.unrulymedia.com/csync/ Frame B504
Redirect Chain

https://sync.1rx.io/usersync2/floor6&gdpr=0&gdpr_consent=
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=183323512
https://sync.1rx.io/usersync/tradedesk/415681b5-feef-403e-8676-1b40a94b0535
https://sync.targeting.unrulymedia.com/csync/RX-bec1049d-2c1d-46d8-8418-2079be285fbc-003

43 B
395 B

14ms
14ms

Image
image/gif

213.19.147.45
RHYTHMONE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.targeting.unrulymedia.com/csync/RX-bec1049d-2c1d-46d8-8418-2079be285fbc-003
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 213.19.147.45 , United Kingdom, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software: Tengine /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
server: Tengine
content-length: 43
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"

Redirect headers

location: https://sync.targeting.unrulymedia.com/csync/RX-bec1049d-2c1d-46d8-8418-2079be285fbc-003
pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
cache-control: no-store, no-cache, must-revalidate
server: Tengine
content-type: text/html
expires: 0

GET
H2

200

usersync
rtb.gumgum.com/ Frame B504
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://rtb.gumgum.com/usersync?b=pln&i=9s1UdlkzF97K&ev=1&pid=558355

35 B
208 B

35ms
35ms

Image
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.gumgum.com/usersync?b=pln&i=9s1UdlkzF97K&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
content-type: image/gif;charset=UTF-8
cache-control: private, no-store, must-revalidate, max-age=0
timing-allow-origin: *
content-length: 35
expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://rtb.gumgum.com/usersync?b=pln&i=9s1UdlkzF97K&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-stage-0
expires: -1

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame B504 0
75 B 74ms
24ms Image
text/plain 185.86.139.104
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=15
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.139.104 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:01 GMT
content-length: 0

GET
H2 200 sync
ads.servenobid.com/ Frame B504 0
358 B 34ms
29ms Image
image/avif 54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=309&uid=e_732458a5-f5bb-4f30-b514-86566fd7e3a9
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 11BC
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2frtb.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://rtb.gumgum.com/usersync?b=mmh&i=38c76234-7bfb-4b01-ae5d-d9c052df8354&gdpr=0&gdpr_consent=

35 B
208 B

35ms
35ms

Document
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=mmh&i=38c76234-7bfb-4b01-ae5d-d9c052df8354&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Date: Fri, 18 Mar 2022 12:33:02 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Access-Control-Allow-Origin: *
Server: MT3 4256 109297d master zrh-pixel-x28 config:1.0.0
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://rtb.gumgum.com/usersync?b=mmh&i=38c76234-7bfb-4b01-ae5d-d9c052df8354&gdpr=0&gdpr_consent=
Expires: Fri, 18 Mar 2022 12:33:01 GMT

GET
H/1.1

200
OK

usersync Show response
usersync.gumgum.com/ Frame C23C
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YjR7-gAOE2mxgABH
https://usersync.gumgum.com/usersync?b=atm&i=YjR7-gAOE2mxgABH&gdpr=0&gdpr_consent=&_test=YjR7-gAOE2mxgABH

35 B
296 B

83ms
36ms

Document
image/gif

54.216.63.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=YjR7-gAOE2mxgABH&gdpr=0&gdpr_consent=&_test=YjR7-gAOE2mxgABH
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.216.63.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-63-116.eu-west-1.compute.amazonaws.com
Software: envoy /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
content-type: image/gif
content-length: 35
date: Fri, 18 Mar 2022 12:33:01 GMT
x-envoy-upstream-service-time: 6
x-region: ireland
server: envoy

Redirect headers

server: Varnish
retry-after: 0
location: https://usersync.gumgum.com/usersync?b=atm&i=YjR7-gAOE2mxgABH&gdpr=0&gdpr_consent=&_test=YjR7-gAOE2mxgABH
accept-ranges: bytes
date: Fri, 18 Mar 2022 12:33:02 GMT
via: 1.1 varnish
x-served-by: cache-hhn4036-HHN
x-cache: HIT
x-cache-hits: 0
x-timer: S1647606782.378716,VS0,VE0
cache-control: no-cache
pragma: no-cache
content-length: 0

GET
H3 200 pixel Show response
cm.g.doubleclick.net/ Frame 6518 170 B
188 B 17ms
15ms Document
image/png 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV83MzI0NThhNS1mNWJiLTRmMzAtYjUxNC04NjU2NmZkN2UzYTk=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

content-type: image/png
date: Fri, 18 Mar 2022 12:33:02 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame D36C 15 KB
6 KB 40ms
8ms Document
text/html 2.21.141.175
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.21.141.175 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-175.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

last-modified: Tue, 01 Feb 2022 06:38:00 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
server: Apache/2.2.15 (CentOS)
accept-ranges: bytes
content-encoding: gzip
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 5549
content-type: text/html; charset=UTF-8
cache-control: max-age=58549
expires: Sat, 19 Mar 2022 04:48:51 GMT
date: Fri, 18 Mar 2022 12:33:02 GMT
vary: Accept-Encoding

GET
H2 204 /
ssc-cms.33across.com/ps/ Frame 8F39 0
0 819ms
112ms Document
text/plain 67.202.105.23
STEADFAST

General

Check archive.org

Show headers Download Go to

Full URL: https://ssc-cms.33across.com/ps/?m=xch&rt=html&id=0013300001r0t9mAAA&ru=https%3A%2F%2Frtb.gumgum.com%2Fusersync%3Fb%3Dtta%26i%3D33XUSERID33X
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 67.202.105.23 , United States, ASN32748 (STEADFAST, US),
Reverse DNS: ip23.67-202-105.static.steadfastdns.net
Software: 33XP003 /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

x-33x-status: 2000208
server: 33XP003
date: Fri, 18 Mar 2022 12:33:02 GMT

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 4F23
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
https://rtb.gumgum.com/usersync?b=ttd&i=415681b5-feef-403e-8676-1b40a94b0535&t=1650198782

35 B
208 B

34ms
34ms

Document
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=ttd&i=415681b5-feef-403e-8676-1b40a94b0535&t=1650198782
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-type: text/html
content-length: 209
location: https://rtb.gumgum.com/usersync?b=ttd&i=415681b5-feef-403e-8676-1b40a94b0535&t=1650198782
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame 2E28
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

10ms
10ms

Document
text/html

23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
ETag: "40014-119-5d32342a551c0"
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 18 Mar 2022 12:33:02 GMT
Connection: keep-alive
Vary: Accept-Encoding

Redirect headers

server: AkamaiGHost
content-length: 0
location: https://eus.rubiconproject.com/usync.html?p=gumgum
date: Fri, 18 Mar 2022 12:33:02 GMT
access-control-allow-credentials: true
access-control-allow-origin: *

GET
H2 204 um
cs.emxdgt.com/ Frame 99B7 0
0 163ms
11ms Document
text/html 18.195.155.181
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

content-type: text/html
date: Fri, 18 Mar 2022 12:33:01 GMT
content-length: 0

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 9FFC
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://rtb.gumgum.com/usersync?b=sus&i=YjR7-sCo8XsAAHAhsRQAAAAA

35 B
208 B

35ms
35ms

Document
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=sus&i=YjR7-sCo8XsAAHAhsRQAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

Server: nginx
Date: Fri, 18 Mar 2022 12:33:02 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: private
Location: https://rtb.gumgum.com/usersync?b=sus&i=YjR7-sCo8XsAAHAhsRQAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
X-SO-Ads-Time: 4
X-SO-HostName: m-ad256.dc4p.scaleout.jp
X-SO-LB-Hostname: m-tgng23.dc4p.scaleout.jp
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":24,"gdpr":true,"ipv4":"0.0.0.0","key":"YjR7-sCo8XsAAHAhsRQAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad256"}
X-SO-Key: YjR7-sCo8XsAAHAhsRQAAAAA
X-SO-IP: 193.27.14.24
X-SO-Cluster-ID: 24
X-SO-Upstream-ID: m-ad256

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame F69E
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://rtb.gumgum.com/usersync?b=rth&i=KVgBkSi3CMj1h6Te7dTt&pi=gumgum&tc=1

35 B
208 B

35ms
35ms

Document
image/gif

18.202.206.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rth&i=KVgBkSi3CMj1h6Te7dTt&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.202.206.42 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-202-206-42.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
content-type: image/gif;charset=UTF-8
content-length: 35
server: nginx
cache-control: private, no-store, must-revalidate, max-age=0
expires: 0
pragma: no-cache
timing-allow-origin: *

Redirect headers

date: Fri, 18 Mar 2022 12:33:02 GMT Fri, 18 Mar 2022 12:33:02 GMT
location: https://rtb.gumgum.com/usersync?b=rth&i=KVgBkSi3CMj1h6Te7dTt&pi=gumgum&tc=1
cache-control: no-cache, no-store, must-revalidate, private, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 2E28 32 KB
10 KB 9ms
9ms Script
text/html 23.37.42.132
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.37.42.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-37-42-132.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: 084b054ff19b85c2e09fbbccb2e0cdf5d5c0455a9559c36cdc8dbd90da8e087c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Fri, 18 Mar 2022 12:33:02 GMT
Content-Encoding: gzip
Last-Modified: Wed, 02 Mar 2022 16:28:01 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=29272
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9539
Expires: Fri, 18 Mar 2022 20:40:54 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame D36C 0
42 B 602ms
154ms Script
text/plain 192.82.242.209
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=8906017&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.82.242.209 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:01 GMT
content-length: 0

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 2E28 0
239 B 8ms
8ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=L0WEJAEU-1R-JGRU
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Content-Type: image/gif

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 08BB 42 B
64 B 50ms
50ms Fetch
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv9glDT8-vRQgv25DVAW5RF6jGH58DjWw-wlJN0qjn_gmhAV156ZfL7VeOsLVjxPP7Cy7GeDYo1e1r_SdWTJt0zGoAV7OCTdt_Rq-qH28LIk3xpV0-u&sig=Cg0ArKJSzFPSkBewVuFOEAE&id=lidar2&mcvt=1006&p=474,209,564,937&mtos=1006,1006,1006,1006,1006&tos=1006,0,0,0,0&v=20220316&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=1696759606&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1647606778973&rpt=2391&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame B14C 0
344 B 31ms
30ms Image
image/avif 54.194.68.215
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=8830040847740195267&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.68.215 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-68-215.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame B14C
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=YjR7-gAOE2mxgABH&gdpr=0&gdpr_consent=

43 B
405 B

67ms
21ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=YjR7-gAOE2mxgABH&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:02 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1647606782.444117,VS0,VE0
x-served-by: cache-hhn4036-HHN
x-cache: HIT
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=94&partneruserid=YjR7-gAOE2mxgABH&gdpr=0&gdpr_consent=
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 204 /
s.ad.smaato.net/c/ Frame B14C 0
240 B 80ms
19ms Image
text/plain 2600:9000:225f:ce00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/?adExInit=sas&redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D133%26partneruserid%3D$UID&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225f:ce00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:02 GMT
via: 1.1 7da1d60a481ae3940f6605e4b4cab476.cloudfront.net (CloudFront)
server: CloudFront
cache-control: no-cache, must-revalidate
x-amz-cf-pop: TXL50-P2
x-amz-cf-id: zh9nUbyyi9IJ4SeuHOuRA2rU9zwdVN93NeKHdLLIYpQH7b3s31Z5_A==
x-cache: FunctionGeneratedResponse from cloudfront

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame B14C
Redirect Chain

https://x.bidswitch.net/sync?ssp=smartadserver&gdpr=0&gdpr_consent=
https://p.rfihub.com/cm?in=1&pub=20513&ssp=smartadserver
https://x.bidswitch.net/sync?dsp_id=119&user_id=5107433822913037941&expires=30&ssp=smartadserver
https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=f70057e4-38b3-4ce5-b2ab-5a780d291297&gdpr=&gdpr_consent=

43 B
163 B

57ms
21ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=f70057e4-38b3-4ce5-b2ab-5a780d291297&gdpr=&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 18 Mar 2022 12:33:01 GMT
transfer-encoding: chunked
content-type: image/gif

Redirect headers

Location: //rtb-csync.smartadserver.com/redir/?partnerid=31&partneruserid=f70057e4-38b3-4ce5-b2ab-5a780d291297&gdpr=&gdpr_consent=
Date: Fri, 18 Mar 2022 12:33:02 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame B14C
Redirect Chain

https://gu.dyntrk.com/adx/sma/us.php?dynk=sma4rt4bt4fg&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D69%26partneruserid%3DPARTNER_USER_ID%26gdpr%3D$GDPR%26gdp...
https://gu.dyntrk.com/adx/sma/us.php?dynk=sma4rt4bt4fg&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D69%26partneruserid%3DPARTNER_USER_ID%26gdpr%3D$GDPR%26gdp...
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=69&partneruserid=03030002_62347bfe78f59&gdpr=0&gdpr_consent=

43 B
431 B

26ms
24ms

Image
image/gif

185.86.139.114
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=69&partneruserid=03030002_62347bfe78f59&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 18 Mar 2022 12:33:01 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

date: Fri, 18 Mar 2022 12:33:02 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=69&partneruserid=03030002_62347bfe78f59&gdpr=0&gdpr_consent=
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame B5E4 0
729 B 109ms
108ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS