receitas.ninja Open in urlscan Pro
2a06:98c1:3121::3 Public Scan

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 30 Nov 2022 17:26:47 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=31021A52349C421DA05466022213AB12&google_push=ASkJ3Fb1tPkZ4uJ20gCu-mMfSkkScSl4vRlNxHpTCgQ6_-OmMErnqWtQJ1yWx3v43psFhTVPbkAoNMV498mYTPbkwisXB1AczNI
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 29 Nov 2022 17:26:47 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame B053 0
191 B 92ms
35ms Image
text/plain 66.155.71.149
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEL6hgqQUDLK39Y_hJHT-xnI&google_cver=1&google_push=ASkJ3FZoXxM_PQUlXxtUFKepkWvlZdFD0QD_fbi8prrBmyzTzkJwSOFYIB0D0h3WMWHCPTLjbDCA0oTsNaH-22b0nyzcpMdI0g
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.149 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Wed, 30 Nov 2022 17:26:46 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame B053 0
173 B 39ms
16ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEKmi_InodGnoONPPfII_arc&google_cver=1&google_push=ASkJ3FZnF1yCC7C8ZaItDrdpDOrt40CE7Js2Iq1ivoz0RDQ-14NgSzvaUv38WI5CbUHtIh1cRjjQnY7dF6lzxreE0fstkZLsJqI
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:47 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B053
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEJD3zLAu9PLCSnETSoSmwgA&google_cver=1&google_push=ASkJ3FbXLYAXSZrtIkCW6K1w-uupPDs9x1FJfNC8QE-SpUCa-9HPZy7AYhzfnnPNx6ShlJNKxSnPGQUznBPx9Pez...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=s2nBbvRvTiG6Oa10IJeXJg2&google_push=ASkJ3FbXLYAXSZrtIkCW6K1w-uupPDs9x1FJfNC8QE-SpUCa-9HPZy7AYhzfnnPNx6ShlJNKxSnPGQUznBPx9Pez4fMONwZf3qo

170 B
188 B

41ms
22ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=s2nBbvRvTiG6Oa10IJeXJg2&google_push=ASkJ3FbXLYAXSZrtIkCW6K1w-uupPDs9x1FJfNC8QE-SpUCa-9HPZy7AYhzfnnPNx6ShlJNKxSnPGQUznBPx9Pez4fMONwZf3qo

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 30 Nov 2022 17:26:47 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=s2nBbvRvTiG6Oa10IJeXJg2&google_push=ASkJ3FbXLYAXSZrtIkCW6K1w-uupPDs9x1FJfNC8QE-SpUCa-9HPZy7AYhzfnnPNx6ShlJNKxSnPGQUznBPx9Pez4fMONwZf3qo
x-host: tde-deliveryengine-production-59bd69b6c9-d5s54
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame B053
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEJa5q-vOe0WHSAjwNQ4EXmw&google_cver=1&google_push=ASkJ3Fatm763jc3DXBat9-cTuYzVPBMEYsQO3O6UCv4L0WJniA36eKlCC8BrHk7WEoX0uhQ_RtXbDFMs-VhAVumgPskIEb...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEJa5q-vOe0WHSAjwNQ4EXmw&google_cver=1&google_push=ASkJ3Fatm763jc3DXBat9-cTuYzVPBMEYsQO3O6UCv4L0WJniA36eKlCC8BrHk7WEoX0uhQ_RtXbDFMs-VhAVumg...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=iaBOhjE0RUieJdA2F0xWDA&google_push=ASkJ3Fatm763jc3DXBat9-cTuYzVPBMEYsQO3O6UCv4L0WJniA36eKlCC8BrHk7WEoX0uhQ_RtXbDFMs-VhAVum...

170 B
188 B

21ms
21ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=iaBOhjE0RUieJdA2F0xWDA&google_push=ASkJ3Fatm763jc3DXBat9-cTuYzVPBMEYsQO3O6UCv4L0WJniA36eKlCC8BrHk7WEoX0uhQ_RtXbDFMs-VhAVumgPskIEb7_VI0

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=iaBOhjE0RUieJdA2F0xWDA&google_push=ASkJ3Fatm763jc3DXBat9-cTuYzVPBMEYsQO3O6UCv4L0WJniA36eKlCC8BrHk7WEoX0uhQ_RtXbDFMs-VhAVumgPskIEb7_VI0
access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:47 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame B053 0
75 B 142ms
20ms Image
text/plain 185.86.137.121
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEPNcKKB0mNrnm4EMH_O43Y0&google_cver=1&google_push=ASkJ3FY3QQHOEF1vWFi3XW4d3YLUw_xWOxLSGk6F1wT7KdTe9X3Zfb49U-3wxtlAR4MFONnltDV5W55hcUxKlBx6JccN6aZhc_o
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.121 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:47 GMT
content-length: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame B053 0
232 B 53ms
16ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IYnNw98XnQxCMgYwcBtdqPGYkmNOA4IUVFhEUcg6wr1UcvL4M7T6gS-ATOvRCMLru_hupu

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:47 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 2E6C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

20ms
20ms

Document
text/html

2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:47 GMT
expires: Wed, 30 Nov 2022 17:26:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:47 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

sid Show response
mug.criteo.com/ Frame 1806
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=receitas.ninja&sn=ChromeSyncframe&so=0&topUrl=receitas.ninja&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=qEuJ5nx1blZ1NUZTWnhmVFYxOWd1QUdwSk5qWE8xbCs5M2tHQ091aGs0ekppaVNNeUVxNnRyY3I3bUNOUkdhanFlQ0lCQnlWKzdkckJrQitPNkNMR0VBUm5ZZHczUTNTTkhaNFc4YlpkeHVEZ05pRkpEMlRibUpsS0JjcH...

444 B
663 B

50ms
15ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=qEuJ5nx1blZ1NUZTWnhmVFYxOWd1QUdwSk5qWE8xbCs5M2tHQ091aGs0ekppaVNNeUVxNnRyY3I3bUNOUkdhanFlQ0lCQnlWKzdkckJrQitPNkNMR0VBUm5ZZHczUTNTTkhaNFc4YlpkeHVEZ05pRkpEMlRibUpsS0JjcHBMR29US3F1SDBIVzVzeHN1ekFUVTRoWnpvWTc2OGQ0KzZuNWI3Z1I0eXZmQStQSmtNYWoxTnlTZzlWMk5XeURHNmFOTzkvT1FUblRqbXFSWlNKM2dHYTVDNERlQWJPVHRka0czb0UveXowd0tJRVU0UVRyZ2dya2l0ck9tSTdjMzFGamptenN0R2dpZ1BwdHJIV0x2a1pkQTd1NTRhZz09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4998996a36ade2fc674c6310bfd083a01d63ca68d899851879ee1098fc525558

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:46 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1643153
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:46 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=qEuJ5nx1blZ1NUZTWnhmVFYxOWd1QUdwSk5qWE8xbCs5M2tHQ091aGs0ekppaVNNeUVxNnRyY3I3bUNOUkdhanFlQ0lCQnlWKzdkckJrQitPNkNMR0VBUm5ZZHczUTNTTkhaNFc4YlpkeHVEZ05pRkpEMlRibUpsS0JjcHBMR29US3F1SDBIVzVzeHN1ekFUVTRoWnpvWTc2OGQ0KzZuNWI3Z1I0eXZmQStQSmtNYWoxTnlTZzlWMk5XeURHNmFOTzkvT1FUblRqbXFSWlNKM2dHYTVDNERlQWJPVHRka0czb0UveXowd0tJRVU0UVRyZ2dya2l0ck9tSTdjMzFGamptenN0R2dpZ1BwdHJIV0x2a1pkQTd1NTRhZz09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 618439
content-length: 0
expires: 0

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 869A 0
176 B 43ms
17ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://receitas.ninja/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Wed, 30 Nov 2022 17:26:47 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 container.html Show response
b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame DF89 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022112901.js?cb=31071038

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://receitas.ninja/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:46 GMT
expires: Thu, 30 Nov 2023 17:26:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A744 624 B
242 B 46ms
45ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLvOfRCrlZYBGKOZwtgBMAE&v=APEucNUG3vA1CK4QuxEWUNqVPNwLViDRQOlXNPOXJCQqpmik6sX2hOf90BuLeoCPTJXx32kAjesC8IfI8KegR2RyXe6r7CstdwesgQJ5IRUUKxMHgWp6NolV0Q0s5sHgcYlPRdV34oxy8WUuaj3s_TEQ94-31jNNHciqYKuhbSsmewAf10HcX9Y

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame DF89 93 KB
37 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AAzlI5Z1S-zdUdyzEQiw3mzhQikqXTMPloLKBJRs-dPdNbJ4ErSIUlE3KdXGffqUmzznPh5HWKaAJug_RLBUN1k0VVQ8hT9ki3oRP88r1_cYpOibdk2HZXgZc4VofoSA3ZFzMUFu_98S-Z_wUGYxtT6g6-ZrqBFcloKai-VjhV-lKPxS8&dbm_d=AKAmf-AfNepdua35Joraj2XUAAStRRYOCQtuNV7AVZ5EkH8LfyXB-gGRNmkwGtkn0QLYvefH3e0UoMB2VUKTgTRCP2XkUbtTMffPh4bhVZOpLw51HvhWlJ3P-fqtv07l4YqHaXwNi0ilhQw6NKAd4FqEZeJNcPIGzOuYg6RGKkeFnrOk1lE2wgtCeG06oTi78Vr300aZmSDwfYzD2KBRh4l79mMQeZDj9xsGVpCxZuvst23F5SK9-EmarXyrLqqIYwAAMAG_9gLgmk3Y_sRr2R-5rSKRJQ3etIeYoC6t-t5GFNRc-Fz46-_AJQDcumJfzV47OrhPkWH1IqyjHr8YObNmqiiLGmi7Ue3FxZ1FtTWlRKlfTwbh5ar1WrKbEV55MlwQUB7tsCyzYO8MfLrPyoAoZLJj4JHtpsNYvxnMiYEoIVvxA1HabYPfPTEmnBYdqGu8KlLbcALLQoFDhhH0EjbPSNNpy8kqbhGbbStBMV1ba7khP5TUEl6jXa19x3-MANDF0mi0G-Gyj-G3DrZZZiGYB4FTyeptCEaVmfscEucyOpEelwatjoHf9g-7UT6J3GbLarTf3KNtNl36Q-D1GC8QppIJBHhoyhIBWDxLtdpcQwsN-RE_fGtnBAw-nftK661I-S9PMEeRdXdcoTDbxiYzQ3UtfgVVHmEwF6NecKH_tyzXY97ryuSXl4DnZ-NX6a1k02k6-hqCXlBgo7NXJ38K2irBqaRxwXWCh5ftI8An3g7rX-0v5WICLe2TLH-MYKjzaM2cclOC8dJZXOYKwHkmmMbAZN9k7SlIc4Aru-fAvlAhT69gt8vDB98sqnhgRIbMMeGNEAwVfqnrXXRz-nEkOrzXcmEhAQTeOjgkfenGk28A47KdB_Qcy9NNwN-b_gxqB5WMLW41KOyQN5BY2BJaWnYhq6EMck4Xrm1mrpS0iPYCyuHq2oAIEULkrNOzfjzsx0UIacf402bNQNLO-PiFz2u8iVNgE2M4Kvayt6WxMAn0RbgTQSr8ajviip_AJX3Yi7_lnlLUm8preURLphVDXVXRK8HQzKg72jFg9kGvUF-jDtIvxyshr5aA1SekxU6nGny8MFBrJPJvG0izSe2jk8clavGtDU94R1THIWa-ES5DhA3s1Ynm5dls-MDK3PuYp1waExCiqOIaP2pPsJmHt1gOAysygBSQvjyIAzTwuSMIzBDyef4B4hA4EeRv35KMjsnbQzfPcK7EZQrGFMVo2OnEdYIZ4rrzZOGgGFyUoYK6zyWOsm1_eNfw6vF9lKPg18b6KX75TFWJD8H6UJGnfISd7olnm6rEbXo1SiNzr3NI_pEv6nXbOStOVZxf0yjm62Opo6m441zbI3J2ANUwRrzp8S2uyUanUYf8soJU7B6OG17GoEg7WD3AahIdVVOpp6jMCiNF5YfYw5ly_a_9VdHGzJJZrQ71HDsJVzjWFG8OL-ADGKkiMPp0MOqWKbX7ED1SrXgu2WqdOh1HRnREb892dyL5Qfb9E3Zr7xIIo5PuJXmYp1yUDiR2UNv_KaJAKtffIgHyAr3lHlrAIUtc8px22vo_EIaCjsS_g9slFICw4w1_gviwnL6AZHk17gMs1Ba_Cobgv1-RMnAbY22vrSeZBLtFDfq0k8BLQq6vS40g7YYOzsX458AJ7INFOEtGgM-ACs1TM_chFkCdZVsuImlQUu4XR6t4OWzJTad_sNOqJEF0bGnp5V3uzFHx5B1Nq7ZkeJ_6OfMwWSzePzP1uFrwVvfvr1egAzHjfHQipCUP1TmF40PGE8tI7hdMXQ2Mq7RDqyFjUn4SOQteIP_ROCM59t7t4AuzpPt-Y5XUmrVfzSpdhKFzTS5B1LVarD0xIJ_95WalTZFlCN1gXkmvWc2UNLaSWSVgjdGDpNtplVkSu0daRh3dJLaOPwTiZtsZXOvaD5yhOMnMvAb1ggla_1w6ucntEiKuUTYaa0RxJCCxFmEOGBBfAw7E5r3Q4otq-elz5v4mCmbBOR44nfgVzCSxSZdQCtcQotPKCq17CpafLby_Sqav-Sr1o-RrhcZOrRne6VusE1mxaK50WuaqWDy5Gg2bmWS4mAgt8BYZ792IHYAG6VedEZpiwj_1eEKaC51z0mX9p8vql33E8F_gE7Z7PcYAiTwpWVqFpuSBlhmvKh2UyiCnlcm3NlcjUSMsbdr7LoKNbBPzS96aWvQ2GPXCk1YRGpeGdx9-w_HWWlOT_5ckLsjh_faQJEN3uv3X-pMwzZRoTIvdD6y8t-AM_VmP-Zx7DpVN_3OAa0zuyigii4wE95rKM4-AX8tI9rI2HDEFZsvX8eHyEZWyBh3IjBcZTSeCl3kSYZYwGU6-VizdZ1_d-9Fkqu5teA8Wy5_LLOpj4lOEndHrGAgBTwiBFy9uyexxiqJs2gqsVKHYIOi9tw9-FDWuDf2BR1w8TRm5sPX998vSUR3fjl1mAtQS1Sanu2GBmqnG9Tk4lLb-nMyHJJj5YEvaBzobVIVk9d6a0so9jDZKDaq1jDketBTYpagId9qcNdsdb8YyjTtl-NWIOg3Kwkc8OA2J9hUUKH7miBPvADXwSS-9aA3TLujjsG2m56WpKjpQm2QL4sMU-WN4_qmRA-R4HX_5swPKlMeYl425myxvaMkc3GydLHq4L1Besp12KHm5-U6DuBORD0u-BfV6s-pUTWzTqj1FtfLauZeSWKEkKHL73K7VYFIbATqnfq1FQxHbDWxTKzr8y9aXfASNWorOJ-iq2m0NEHnMG7dqTSENVLgUY58LMwUSCZ7GlDRCYKPWPaRZ7rVVSSV62w88do75MHTDL8pDwL7VHo8sCKX8QwxlkJC3k0_rdUJvJ-4017xTLtDe8Pj6HD_dvN2dIJFNyi9Mlei85g624ceih7WjGQop8X6D7FqVejVV9Dk-LGIxyBMdPrzC8QF8Y15B9yZ2LjJEHuokb5IU_UEK80GNy5n3_k1G3BEm9YicjuInGsFX4RBLOEjBiYj1y3HGYkU9YLPcpNfhl2p9Oye_ODkyP795gb3GFlFiVezAb-0ridWWKvfmDS25YVBcJ7MqTLG276sC-vR8BznrgNK5WNfVJFVObF9L-k1-lNIQFH2ITube6THENuJfiiaTfwqr84zGNjATnNmHU94ncafwfmQ07n6YoXQdXpA_87P0TJIoVBTw-zoO-umr7d2C6kusOh3sxMZgrFyHvFNFOpROp1kKbvoaHG0mEQyMt-PMj4MNE6vlefdUc_yOOwviLdBZu4wlEnOC7irmw6Huok8KiulQxNrbuc5oX2yaAERhsGEN1QjDA8StiJ_RGIG8q9uv-zZOJZLG6LHZ_VOWn11oVGlFo9UI8A0OmfyQnRPGO_0xlYFcAyhok8aa__qLp7dB9Wjwc64ppfG068o_Z-gHjltFXawn7qYBBJVXYdqbPxx6IyPOAHcz_HNZuYultosYLshu39OUvCHI-cLs8yPYQUhgtb-_AW6TOJUnf6oupZLGMqzXePqVgcNcaA1JGuuO6LJWfTnKaKfR9UK7wm-Mhi4uhxZZKRwQXLZr7F8d9vyvOuvaklH3o_5421Mfx0nHfjqeydCPR6FqJyCtcMTQ_-WiV8fw8wgkHbTe32nCdWUv8PJ_T_i9HMMqyB7rmTGjfaOCcVN8o4yCrjlcYV2Jyl2c&cid=CAQSOwDq26N9d1Yl12pW3ZuKVWnxb_e9YO7hk9HAZUTZSf9-N52DhEODnb_W3AX_lj_kA225_gFzkJRBG7UiGAEgEw&rfl=1%2Chttps%253A%252F%252Freceitas.ninja%252F%240

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02c966017431df69fc1edf302ba65a7bd93047a442a787b5eafcad60606f8c3d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37810
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame DF89 42 B
63 B 43ms
42ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AwsNfZABAlo43d1XlmnamQrrhyVHluiLTcCoxinDUKg2gjmg6zKKp5smOQUfJp9aM0h0QkgrRf2cN1iEi93p9IkGFEaksCZ_GnBvzrBlSVt6PT4uk

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame DF89 3 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1701
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 16:58:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame DF89 18 KB
7 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DF89 0
0 16ms
15ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTdkc70tcZErDZ3BYzjTqkFrwb6t04ahQuqIHOMOrmN2i4dRqtXcBPv_pHc327AAOt5TP25cEJzVxV3UQt9J-i4_Havjw
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DF89 154 KB
47 KB 39ms
22ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 17:26:47 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A744
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENwZbyXhyGonvYkqydGTSwQ&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENwZbyXhyGonvYkqydGTSwQ&google_cver=1&C=1

43 B
766 B

11ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENwZbyXhyGonvYkqydGTSwQ&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLvOfRCrlZYBGKOZwtgBMAE&v=APEucNUG3vA1CK4QuxEWUNqVPNwLViDRQOlXNPOXJCQqpmik6sX2hOf90BuLeoCPTJXx32kAjesC8IfI8KegR2RyXe6r7CstdwesgQJ5IRUUKxMHgWp6NolV0Q0s5sHgcYlPRdV34oxy8WUuaj3s_TEQ94-31jNNHciqYKuhbSsmewAf10HcX9Y
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESENwZbyXhyGonvYkqydGTSwQ&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A744
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENwZbyXhyGonvYkqydGTSwQ&google_cver=1

43 B
766 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENwZbyXhyGonvYkqydGTSwQ&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLvOfRCrlZYBGKOZwtgBMAE&v=APEucNUG3vA1CK4QuxEWUNqVPNwLViDRQOlXNPOXJCQqpmik6sX2hOf90BuLeoCPTJXx32kAjesC8IfI8KegR2RyXe6r7CstdwesgQJ5IRUUKxMHgWp6NolV0Q0s5sHgcYlPRdV34oxy8WUuaj3s_TEQ94-31jNNHciqYKuhbSsmewAf10HcX9Y
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:47 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENwZbyXhyGonvYkqydGTSwQ&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame A744
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELDVlBj879GQlZ1GQMY1c38&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELDVlBj879GQlZ1GQMY1c38%26google_cver%3D1

43 B
1 KB

21ms
21ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELDVlBj879GQlZ1GQMY1c38%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLvOfRCrlZYBGKOZwtgBMAE&v=APEucNUG3vA1CK4QuxEWUNqVPNwLViDRQOlXNPOXJCQqpmik6sX2hOf90BuLeoCPTJXx32kAjesC8IfI8KegR2RyXe6r7CstdwesgQJ5IRUUKxMHgWp6NolV0Q0s5sHgcYlPRdV34oxy8WUuaj3s_TEQ94-31jNNHciqYKuhbSsmewAf10HcX9Y

Protocol

HTTP/1.1

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:47 GMT
AN-X-Request-Uuid: 1961bc1d-6c38-4c8d-b4cc-9f43d7029b40
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:47 GMT
AN-X-Request-Uuid: ffa4c9a4-d6cf-4dcd-9528-7cc9b697e316
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESELDVlBj879GQlZ1GQMY1c38%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A744
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:47 GMT
AN-X-Request-Uuid: 14ef9eff-af34-4465-abf0-0f59d45790fb
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1249092/67007136/ Frame DF89 46 KB
12 KB 371ms
30ms Script
application/javascript 34.251.222.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1249092/67007136/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1009185319&ias_pubId=pub-4894209870857905&ias_chanId=1&ias_placementId=18336894882&bidurl=https://receitas.ninja/saque-fgts/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iPalDXLMQWmCyyP5BaAbzJ
Requested by: Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.222.172 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-222-172.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 8598baceaf8add8b9e592862fc424d57d34ea6709c909c594059234fd593d4e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame DF89 170 KB
59 KB 46ms
8ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Origin: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 10:10:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 26158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Dec 2022 10:10:49 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame DF89 8 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AAzlI5Z1S-zdUdyzEQiw3mzhQikqXTMPloLKBJRs-dPdNbJ4ErSIUlE3KdXGffqUmzznPh5HWKaAJug_RLBUN1k0VVQ8hT9ki3oRP88r1_cYpOibdk2HZXgZc4VofoSA3ZFzMUFu_98S-Z_wUGYxtT6g6-ZrqBFcloKai-VjhV-lKPxS8&dbm_d=AKAmf-AfNepdua35Joraj2XUAAStRRYOCQtuNV7AVZ5EkH8LfyXB-gGRNmkwGtkn0QLYvefH3e0UoMB2VUKTgTRCP2XkUbtTMffPh4bhVZOpLw51HvhWlJ3P-fqtv07l4YqHaXwNi0ilhQw6NKAd4FqEZeJNcPIGzOuYg6RGKkeFnrOk1lE2wgtCeG06oTi78Vr300aZmSDwfYzD2KBRh4l79mMQeZDj9xsGVpCxZuvst23F5SK9-EmarXyrLqqIYwAAMAG_9gLgmk3Y_sRr2R-5rSKRJQ3etIeYoC6t-t5GFNRc-Fz46-_AJQDcumJfzV47OrhPkWH1IqyjHr8YObNmqiiLGmi7Ue3FxZ1FtTWlRKlfTwbh5ar1WrKbEV55MlwQUB7tsCyzYO8MfLrPyoAoZLJj4JHtpsNYvxnMiYEoIVvxA1HabYPfPTEmnBYdqGu8KlLbcALLQoFDhhH0EjbPSNNpy8kqbhGbbStBMV1ba7khP5TUEl6jXa19x3-MANDF0mi0G-Gyj-G3DrZZZiGYB4FTyeptCEaVmfscEucyOpEelwatjoHf9g-7UT6J3GbLarTf3KNtNl36Q-D1GC8QppIJBHhoyhIBWDxLtdpcQwsN-RE_fGtnBAw-nftK661I-S9PMEeRdXdcoTDbxiYzQ3UtfgVVHmEwF6NecKH_tyzXY97ryuSXl4DnZ-NX6a1k02k6-hqCXlBgo7NXJ38K2irBqaRxwXWCh5ftI8An3g7rX-0v5WICLe2TLH-MYKjzaM2cclOC8dJZXOYKwHkmmMbAZN9k7SlIc4Aru-fAvlAhT69gt8vDB98sqnhgRIbMMeGNEAwVfqnrXXRz-nEkOrzXcmEhAQTeOjgkfenGk28A47KdB_Qcy9NNwN-b_gxqB5WMLW41KOyQN5BY2BJaWnYhq6EMck4Xrm1mrpS0iPYCyuHq2oAIEULkrNOzfjzsx0UIacf402bNQNLO-PiFz2u8iVNgE2M4Kvayt6WxMAn0RbgTQSr8ajviip_AJX3Yi7_lnlLUm8preURLphVDXVXRK8HQzKg72jFg9kGvUF-jDtIvxyshr5aA1SekxU6nGny8MFBrJPJvG0izSe2jk8clavGtDU94R1THIWa-ES5DhA3s1Ynm5dls-MDK3PuYp1waExCiqOIaP2pPsJmHt1gOAysygBSQvjyIAzTwuSMIzBDyef4B4hA4EeRv35KMjsnbQzfPcK7EZQrGFMVo2OnEdYIZ4rrzZOGgGFyUoYK6zyWOsm1_eNfw6vF9lKPg18b6KX75TFWJD8H6UJGnfISd7olnm6rEbXo1SiNzr3NI_pEv6nXbOStOVZxf0yjm62Opo6m441zbI3J2ANUwRrzp8S2uyUanUYf8soJU7B6OG17GoEg7WD3AahIdVVOpp6jMCiNF5YfYw5ly_a_9VdHGzJJZrQ71HDsJVzjWFG8OL-ADGKkiMPp0MOqWKbX7ED1SrXgu2WqdOh1HRnREb892dyL5Qfb9E3Zr7xIIo5PuJXmYp1yUDiR2UNv_KaJAKtffIgHyAr3lHlrAIUtc8px22vo_EIaCjsS_g9slFICw4w1_gviwnL6AZHk17gMs1Ba_Cobgv1-RMnAbY22vrSeZBLtFDfq0k8BLQq6vS40g7YYOzsX458AJ7INFOEtGgM-ACs1TM_chFkCdZVsuImlQUu4XR6t4OWzJTad_sNOqJEF0bGnp5V3uzFHx5B1Nq7ZkeJ_6OfMwWSzePzP1uFrwVvfvr1egAzHjfHQipCUP1TmF40PGE8tI7hdMXQ2Mq7RDqyFjUn4SOQteIP_ROCM59t7t4AuzpPt-Y5XUmrVfzSpdhKFzTS5B1LVarD0xIJ_95WalTZFlCN1gXkmvWc2UNLaSWSVgjdGDpNtplVkSu0daRh3dJLaOPwTiZtsZXOvaD5yhOMnMvAb1ggla_1w6ucntEiKuUTYaa0RxJCCxFmEOGBBfAw7E5r3Q4otq-elz5v4mCmbBOR44nfgVzCSxSZdQCtcQotPKCq17CpafLby_Sqav-Sr1o-RrhcZOrRne6VusE1mxaK50WuaqWDy5Gg2bmWS4mAgt8BYZ792IHYAG6VedEZpiwj_1eEKaC51z0mX9p8vql33E8F_gE7Z7PcYAiTwpWVqFpuSBlhmvKh2UyiCnlcm3NlcjUSMsbdr7LoKNbBPzS96aWvQ2GPXCk1YRGpeGdx9-w_HWWlOT_5ckLsjh_faQJEN3uv3X-pMwzZRoTIvdD6y8t-AM_VmP-Zx7DpVN_3OAa0zuyigii4wE95rKM4-AX8tI9rI2HDEFZsvX8eHyEZWyBh3IjBcZTSeCl3kSYZYwGU6-VizdZ1_d-9Fkqu5teA8Wy5_LLOpj4lOEndHrGAgBTwiBFy9uyexxiqJs2gqsVKHYIOi9tw9-FDWuDf2BR1w8TRm5sPX998vSUR3fjl1mAtQS1Sanu2GBmqnG9Tk4lLb-nMyHJJj5YEvaBzobVIVk9d6a0so9jDZKDaq1jDketBTYpagId9qcNdsdb8YyjTtl-NWIOg3Kwkc8OA2J9hUUKH7miBPvADXwSS-9aA3TLujjsG2m56WpKjpQm2QL4sMU-WN4_qmRA-R4HX_5swPKlMeYl425myxvaMkc3GydLHq4L1Besp12KHm5-U6DuBORD0u-BfV6s-pUTWzTqj1FtfLauZeSWKEkKHL73K7VYFIbATqnfq1FQxHbDWxTKzr8y9aXfASNWorOJ-iq2m0NEHnMG7dqTSENVLgUY58LMwUSCZ7GlDRCYKPWPaRZ7rVVSSV62w88do75MHTDL8pDwL7VHo8sCKX8QwxlkJC3k0_rdUJvJ-4017xTLtDe8Pj6HD_dvN2dIJFNyi9Mlei85g624ceih7WjGQop8X6D7FqVejVV9Dk-LGIxyBMdPrzC8QF8Y15B9yZ2LjJEHuokb5IU_UEK80GNy5n3_k1G3BEm9YicjuInGsFX4RBLOEjBiYj1y3HGYkU9YLPcpNfhl2p9Oye_ODkyP795gb3GFlFiVezAb-0ridWWKvfmDS25YVBcJ7MqTLG276sC-vR8BznrgNK5WNfVJFVObF9L-k1-lNIQFH2ITube6THENuJfiiaTfwqr84zGNjATnNmHU94ncafwfmQ07n6YoXQdXpA_87P0TJIoVBTw-zoO-umr7d2C6kusOh3sxMZgrFyHvFNFOpROp1kKbvoaHG0mEQyMt-PMj4MNE6vlefdUc_yOOwviLdBZu4wlEnOC7irmw6Huok8KiulQxNrbuc5oX2yaAERhsGEN1QjDA8StiJ_RGIG8q9uv-zZOJZLG6LHZ_VOWn11oVGlFo9UI8A0OmfyQnRPGO_0xlYFcAyhok8aa__qLp7dB9Wjwc64ppfG068o_Z-gHjltFXawn7qYBBJVXYdqbPxx6IyPOAHcz_HNZuYultosYLshu39OUvCHI-cLs8yPYQUhgtb-_AW6TOJUnf6oupZLGMqzXePqVgcNcaA1JGuuO6LJWfTnKaKfR9UK7wm-Mhi4uhxZZKRwQXLZr7F8d9vyvOuvaklH3o_5421Mfx0nHfjqeydCPR6FqJyCtcMTQ_-WiV8fw8wgkHbTe32nCdWUv8PJ_T_i9HMMqyB7rmTGjfaOCcVN8o4yCrjlcYV2Jyl2c&cid=CAQSOwDq26N9d1Yl12pW3ZuKVWnxb_e9YO7hk9HAZUTZSf9-N52DhEODnb_W3AX_lj_kA225_gFzkJRBG7UiGAEgEw&rfl=1%2Chttps%253A%252F%252Freceitas.ninja%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame DF89 29 KB
11 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18274
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame DF89 41 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191073
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:14 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2103 1 KB
643 B 8ms
8ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 24161
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 10:44:06 GMT
etag: 48472445140208031
expires: Thu, 01 Dec 2022 10:44:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame DF89 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 241f94e9b02621f67db08c8240c2b1e918a85d4e1e4d3fe923d555661a2a55a0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CD23 22 KB
8 KB 13ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 133262
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 04:25:46 GMT
expires: Wed, 29 Nov 2023 04:25:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 2103 0
104 B 302ms
24ms Image
text/plain 2a02:fa8:8806:20::2040
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEPYgDOKRdQ54ZMOjEKVRrC8&google_cver=1&google_push=ASkJ3FZT_H0Acj-9UITRckIxWzFD3AzQvs1T9XjXgxkB9fT4R2DYQnYZ0YdnJrWhfBuBoROwN16M7IgmgITMzxPCGMzVjwED8g
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:20::2040 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2103
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEBdQO43r9rvPlbVMvuDlCNs&google_cver=1&google_push=ASkJ3FbhTrFgz9bqC0BqVFUWjtM8dqHrl8RqBECm3V0_iRI7jAAp-RaMzEwRKsAgycDKcjMGWFqpeHF2IeQV3Ikr...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3FbhTrFgz9bqC0BqVFUWjtM8dqHrl8RqBECm3V0_iRI7jAAp-RaMzEwRKsAgycDKcjMGWFqpeHF2IeQV3Ikrv7vSKA_HhFU

170 B
188 B

20ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3FbhTrFgz9bqC0BqVFUWjtM8dqHrl8RqBECm3V0_iRI7jAAp-RaMzEwRKsAgycDKcjMGWFqpeHF2IeQV3Ikrv7vSKA_HhFU

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 30 Nov 2022 17:26:48 GMT
Server: MT3 169 32252b7 master cdg-pixel-x32 config:1.0.0
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ASkJ3FbhTrFgz9bqC0BqVFUWjtM8dqHrl8RqBECm3V0_iRI7jAAp-RaMzEwRKsAgycDKcjMGWFqpeHF2IeQV3Ikrv7vSKA_HhFU
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Wed, 30 Nov 2022 17:26:47 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 2103 70 B
265 B 311ms
33ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESENmg_2ob-a4elmFFuSZ8I9M&google_cver=1&google_push=ASkJ3FbG37PTPJ-sv0VWSQekli0CPdCcJZqfLSekOOO9K0QNpln8kR7IZgbV0dTgKDQHK1h2OebV0GwWwJ3sP_XVBWM5-wywg48
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2103
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEANbHXK_ovvDOlabgMclwLM&google_cver=1&google_push=ASkJ3FbRr20OorQllOQ5KSI-El5ZdeKAHOEvlOWX8JjiMztu187eY9CoKoUBEKpKu7i_-FC8SmpvQPomha0CeHv7...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=s2nBbvRvTiG6Oa10IJeXJg2&google_push=ASkJ3FbRr20OorQllOQ5KSI-El5ZdeKAHOEvlOWX8JjiMztu187eY9CoKoUBEKpKu7i_-FC8SmpvQPomha0CeHv7FGoCO7cimH4

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=s2nBbvRvTiG6Oa10IJeXJg2&google_push=ASkJ3FbRr20OorQllOQ5KSI-El5ZdeKAHOEvlOWX8JjiMztu187eY9CoKoUBEKpKu7i_-FC8SmpvQPomha0CeHv7FGoCO7cimH4

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 30 Nov 2022 17:26:47 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=s2nBbvRvTiG6Oa10IJeXJg2&google_push=ASkJ3FbRr20OorQllOQ5KSI-El5ZdeKAHOEvlOWX8JjiMztu187eY9CoKoUBEKpKu7i_-FC8SmpvQPomha0CeHv7FGoCO7cimH4
x-host: tde-deliveryengine-production-59bd69b6c9-5s47d
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2103
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEDUX1rhP1iolKlcjEjrf8Jc&google_cver=1&google_push=ASkJ3FZuJ3KmUyazljzcEekHoi65nj0NyQr2102avifo5_PijXxky4pH70JMD2ZFAO9jvdKkYXutarlP...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEDUX1rhP1iolKlcjEjrf8Jc&google_cver=1&google_push=ASkJ3FZuJ3KmUyazljzcEekHoi65nj0NyQr2102avifo5_PijXxky4pH70JMD2ZFAO9jvdKkYXu...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzYyMTUwNTMxNzkwMTY0ODM1NQ&google_push=ASkJ3FZuJ3KmUyazljzcEekHoi65nj0NyQr2102avifo5_PijXxky4pH70JMD2ZFAO9jvdKkYXutar...

170 B
188 B

22ms
22ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzYyMTUwNTMxNzkwMTY0ODM1NQ&google_push=ASkJ3FZuJ3KmUyazljzcEekHoi65nj0NyQr2102avifo5_PijXxky4pH70JMD2ZFAO9jvdKkYXutarlP5W-ByIDmL9-Sa7H6h1o

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzYyMTUwNTMxNzkwMTY0ODM1NQ&google_push=ASkJ3FZuJ3KmUyazljzcEekHoi65nj0NyQr2102avifo5_PijXxky4pH70JMD2ZFAO9jvdKkYXutarlP5W-ByIDmL9-Sa7H6h1o
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2103
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEBvXNCJb6kkEspWceAihzfI&google_cver=1&google_push=ASkJ3FatXmlsHXT3qN_kiSTgVU2mvNV1-Rohxa05mgBQuOpTWWgTZ9ivF6n5YvNsp7F5UzQcIDulW54CuyO9HrF4...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ASkJ3FatXmlsHXT3qN_kiSTgVU2mvNV1-Rohxa05mgBQuOpTWWgTZ9ivF6n5YvNsp7F5UzQcIDulW54CuyO9HrF4dxkAItuU-GE

170 B
188 B

17ms
17ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ASkJ3FatXmlsHXT3qN_kiSTgVU2mvNV1-Rohxa05mgBQuOpTWWgTZ9ivF6n5YvNsp7F5UzQcIDulW54CuyO9HrF4dxkAItuU-GE

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 30 Nov 2022 17:26:48 GMT
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-P5
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ASkJ3FatXmlsHXT3qN_kiSTgVU2mvNV1-Rohxa05mgBQuOpTWWgTZ9ivF6n5YvNsp7F5UzQcIDulW54CuyO9HrF4dxkAItuU-GE
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: WYyAMgZ-FE8fsqbPUDRcLFryufgtTFDtCt2xWjl6lvqalzHQRqzJ6w==

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 2103 0
75 B 22ms
20ms Image
text/plain 185.86.137.121
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEOKHZUpgttE5ajnJnA-8l2A&google_cver=1&google_push=ASkJ3FaB5-CaDGwDs5Gig55k24fNIquARRDcZ9CqPIOPXn272XF5CVD7cBuCseILDDhfJnGicKCo2MHCo3RI5rT5aJ0TVC-e1b4
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.121 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:47 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2103 0
12 B 17ms
16ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J7ZjbmC5ZeUrTH0v75jBx8ypNPnTLGlVZuogGmKz34SMZWxKxC0eR3FuGOofbPW61au-nO

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:47 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 86 KB
22 KB 34ms
17ms Document
text/html 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

148e5fe86d61f1912779bf075824cd45b7bf20a576fb09340110647fdcb57291

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:48 GMT
expires: Thu, 30 Nov 2023 17:26:48 GMT
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame DF89 0
0 312ms
51ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstCrUr3nKG588IzUTtv3MR6tmVofcowNH3DqqdiKPhq7svLOjuwl7h4E_EVwHTSulXI27EI7RhDlrmvP59Y5ibDHTXeU_Tt3w1LgH3qSu0qqMpE-WzVqUlXV3wZ1aoVeh2OpXUVKTfmdKHnr0o5FJvuhPSRbkLalFRUAgh6kMkK32vWI2stW-RY9dttveAaO_qfke4LBLOFTxRFGGbfieBiVfxQKwNWhEwk_SwBtbP4hU8bPWNze6T8FwDtrpMlp4Up4E4eNh2gXr6HJZ5VqXYt_--Co2mjm8-lzyQPAGDGd6s1AoDCjQkEV8jz8fxHKdUahF7h05rXlj-yZRRrbORhR5oK2-7IRYI14wVYcbLdaeWc-nQAaPA_4P5Bp5ZOcNULtH5GvegGjbbnopTTxWL-rn4Kmd_X9GgU1OTKTPVUJIjJeAdFxZN9CkZXgunWOUm1F5Zn96KEZy_eCDoVYMGq5JCE_sHf0bmW4RJ_7_AIwNca5knh8JJWYfvRvKwkWHFh7KG1nrlGe35IYo-NbSbfLuR6zjFop71uhYFeDVWAi0HzBu70I8dTCjsffblpWDP1OTKQMHi48GHtqEnSaeERbuRWmpfepor0GwcZQOfUiN3cbiWCPSHL9dUS4Bq1sdPqsktjsKmHWvAY67T18JlvUp-_tJZEmfeJPwz_wVEpmJEaZ1Dtbz4pOfAhEKdKY3mTzBo3BhVtGTUcp-853RicMXKFDk1yU85rAs94LgChs9XY7rfE0M3N4VVFFiaPBh6zeXAeSd-EaaD0HqX16-1Zfc9KtDylG7qE50uJTBfYGzLYyJxBtnWi8xV1qrBOy-P_bt_8z8Q3hi5ON68Mq5XaK9peKt5b9aa8ibZ0RQyrJNEvwFYmgDd2Fx8yM9LVz94BWN05p9HnQtMqP0TjoLxQXyj4ivI8DqxIdChNGj1JCxuD6m_vabfpTb8ZZer1iMvEwaTmCeZfLVviZJixs4tYzF4a2EigpW0OdDjxp_i6QWybFaWV8KzFuUoU07BzvM2KTad8_FFoH91PIAisCErdb2boWNdbs7bc5xrOCLHU2APZNGY-ATF1xDOvZDQK6FqvYes9hpglPnte2B5TWNs8h7v-R2M1KqWlgu9e_Kztb8gBnRfyqOXFp1VZ-xUin8b1RtSWVqTimXqPvwKgG85E6ikJlQMOHQ8ysYFKBxum-iGcNMfTy9GPE-q7XlEPTApnwR8035gXUmw916041oNE2h28c_F_Ra7U8V9UO0RaMSNszoTgaYZcyzWv32pRV_Gy10VLoUaKMve4BGwzxSTouOWlhx1TaA&sai=AMfl-YQ0rDmOC8uxffRh3IaMf-x-ix70vf79Nwenr-IHKvVldJr9RK21dD2CTEyBDkgJEnjoJ9qKoJGn-5dlryyYKqj7RqbHnx6vhdkWmQrXdxnNifyyRbsMzjw_C1az-K2wHB7uyZ_6BcBovmYs_plti3SzNh32GGP3elZhEz0NZhlyA7xZRxOKRTPYO9qTAy8I3l5GKLUqVUxHj47Aigw08vCcdojzozECSV8BFwtRBgKIT8LbzqOvCHfZG38l8L-p8OjPEtwB9as&sig=Cg0ArKJSzAwpasVvXvdZEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=80&cbvp=1&cstd=73&cisv=r20221110.69625&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H3 200 script-push.js Show response
script.joinads.me/ 1 KB
1 KB 61ms
32ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.joinads.me/script-push.js
Requested by: Host: script.joinads.me
URL: https://script.joinads.me/push-notification.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3cb238c7630ba8bd60ede523b57d4b3619086b3c54c04297662d2fddc65c6c4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://receitas.ninja/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 191300
cf-polished: origSize=1468
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-bgj: minify
last-modified: Thu, 01 Apr 2021 12:59:37 GMT
server: cloudflare
etag: W/"6065c3b9-5bc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xu330vPre1n%2BKZUDuaS9IA8U9WwlZNbm91ABzhXc4pp1dja4U08zcylcWNphaJTn4xhmxk7zzc1cUVeMeG4zSI42DEjkLsguoeNp%2FOqMqVVtxpCaIX5YAzdLOnL7aG0sFNXaKVydDb18iHTyCIeBPg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=31104000
cf-ray: 77254a464ae3162f-DUS
expires: Thu, 23 Nov 2023 12:18:28 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7155 0
20 B 43ms
43ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=jca&jc=39&version=r20221110&sample=0.01

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-3685392670532966&output=html&adk=1812271804&adf=3025194257&lmt=1669829205&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32&format=0x0&url=https%3A%2F%2Freceitas.ninja%2Fsaque-fgts%2F%3Futm_source%3Dactive%26utm_medium%3Demail%26utm_campaign%3Dgl_email%26vgo_ee%3Dla0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%253D&ea=0&host=ca-host-pub-2644536267352236&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&dt=1669829205620&bpp=4&bdt=768&idt=251&shv=r20221110&mjsv=m202211150101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=4503473491977&frm=20&pv=2&ga_vid=197835490.1669829206&ga_sid=1669829206&ga_hid=964274107&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C42531706%2C31070993%2C44770881&oid=2&pvsid=152933649832243&tmod=1451565285&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=267

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/ 150 KB
51 KB 107ms
106ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202211150101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

392d75cb3465c0d2b0d1bd16ee2a0a7e5d9b5d9c2806550df11d717e843d4195

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://receitas.ninja/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52286
x-xss-protection: 0
server: cafe
etag: 4699092079664772280
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame CD23 36 KB
16 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:56:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1826
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 Nov 2023 16:56:22 GMT

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame E9B1 118 KB
40 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 10:10:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 26158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Dec 2022 10:10:50 GMT

GET
H2 200 main.19.8.366.js Show response
static.adsafeprotected.com/ Frame DF89 196 KB
61 KB 45ms
8ms Script
application/javascript 2600:9000:223f:9600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.366.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1249092/67007136/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1009185319&ias_pubId=pub-4894209870857905&ias_chanId=1&ias_placementId=18336894882&bidurl=https://receitas.ninja/saque-fgts/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0iPalDXLMQWmCyyP5BaAbzJ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:9600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: eb6cb0bc1769b5545101b7c78affadfff0dfcd0157d2a2b3c71eb4b129942699

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Mon, 21 Nov 2022 21:37:52 GMT
x-amz-version-id: DTz7DAGx5H1oATkuvwxjIs9w8gvuFjKB
content-encoding: gzip
via: 1.1 98652de9f742fc1df9de714d921e14c2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 762536
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 21 Nov 2022 19:50:49 GMT
server: AmazonS3
etag: W/"ca4194ffbaa3712186a83d16b497895d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: K3tlA7k9Mnga5_6hEvhEzFFU9TRxgPecZ5zfDdAICunaNu3NeXH5aQ==

GET
H3 200 poster.jpg
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 17 KB
17 KB 12ms
12ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/poster.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de608f70b0878af0836609d7368904b4dee70f73d0821e3e3f56d19e22cda466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 23:03:23 GMT
x-content-type-options: nosniff
age: 325405
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17701
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 23:03:23 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame DF89 0
0 61ms
45ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstCrUr3nKG588IzUTtv3MR6tmVofcowNH3DqqdiKPhq7svLOjuwl7h4E_EVwHTSulXI27EI7RhDlrmvP59Y5ibDHTXeU_Tt3w1LgH3qSu0qqMpE-WzVqUlXV3wZ1aoVeh2OpXUVKTfmdKHnr0o5FJvuhPSRbkLalFRUAgh6kMkK32vWI2stW-RY9dttveAaO_qfke4LBLOFTxRFGGbfieBiVfxQKwNWhEwk_SwBtbP4hU8bPWNze6T8FwDtrpMlp4Up4E4eNh2gXr6HJZ5VqXYt_--Co2mjm8-lzyQPAGDGd6s1AoDCjQkEV8jz8fxHKdUahF7h05rXlj-yZRRrbORhR5oK2-7IRYI14wVYcbLdaeWc-nQAaPA_4P5Bp5ZOcNULtH5GvegGjbbnopTTxWL-rn4Kmd_X9GgU1OTKTPVUJIjJeAdFxZN9CkZXgunWOUm1F5Zn96KEZy_eCDoVYMGq5JCE_sHf0bmW4RJ_7_AIwNca5knh8JJWYfvRvKwkWHFh7KG1nrlGe35IYo-NbSbfLuR6zjFop71uhYFeDVWAi0HzBu70I8dTCjsffblpWDP1OTKQMHi48GHtqEnSaeERbuRWmpfepor0GwcZQOfUiN3cbiWCPSHL9dUS4Bq1sdPqsktjsKmHWvAY67T18JlvUp-_tJZEmfeJPwz_wVEpmJEaZ1Dtbz4pOfAhEKdKY3mTzBo3BhVtGTUcp-853RicMXKFDk1yU85rAs94LgChs9XY7rfE0M3N4VVFFiaPBh6zeXAeSd-EaaD0HqX16-1Zfc9KtDylG7qE50uJTBfYGzLYyJxBtnWi8xV1qrBOy-P_bt_8z8Q3hi5ON68Mq5XaK9peKt5b9aa8ibZ0RQyrJNEvwFYmgDd2Fx8yM9LVz94BWN05p9HnQtMqP0TjoLxQXyj4ivI8DqxIdChNGj1JCxuD6m_vabfpTb8ZZer1iMvEwaTmCeZfLVviZJixs4tYzF4a2EigpW0OdDjxp_i6QWybFaWV8KzFuUoU07BzvM2KTad8_FFoH91PIAisCErdb2boWNdbs7bc5xrOCLHU2APZNGY-ATF1xDOvZDQK6FqvYes9hpglPnte2B5TWNs8h7v-R2M1KqWlgu9e_Kztb8gBnRfyqOXFp1VZ-xUin8b1RtSWVqTimXqPvwKgG85E6ikJlQMOHQ8ysYFKBxum-iGcNMfTy9GPE-q7XlEPTApnwR8035gXUmw916041oNE2h28c_F_Ra7U8V9UO0RaMSNszoTgaYZcyzWv32pRV_Gy10VLoUaKMve4BGwzxSTouOWlhx1TaA&sai=AMfl-YQ0rDmOC8uxffRh3IaMf-x-ix70vf79Nwenr-IHKvVldJr9RK21dD2CTEyBDkgJEnjoJ9qKoJGn-5dlryyYKqj7RqbHnx6vhdkWmQrXdxnNifyyRbsMzjw_C1az-K2wHB7uyZ_6BcBovmYs_plti3SzNh32GGP3elZhEz0NZhlyA7xZRxOKRTPYO9qTAy8I3l5GKLUqVUxHj47Aigw08vCcdojzozECSV8BFwtRBgKIT8LbzqOvCHfZG38l8L-p8OjPEtwB9as&sig=Cg0ArKJSzAwpasVvXvdZEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=461&vt=11&dtpt=381&dett=3&cstd=73&cisv=r20221110.69625&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 33ms
17ms Script
application/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=receitas.ninja

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://receitas.ninja/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 35ms
17ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=receitas.ninja

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://receitas.ninja/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/ Frame DC13 10 KB
4 KB 8ms
8ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://receitas.ninja/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 24171
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 10:43:57 GMT
etag: 10353107486223812946
expires: Wed, 14 Dec 2022 10:43:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/ Frame 32DB 10 KB
4 KB 8ms
8ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9da238ca619f3bf71312de3c9c913c653941ada56cb5e1601aafb6094ae51cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://receitas.ninja/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 24171
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 10:43:57 GMT
etag: 10353107486223812946
expires: Wed, 14 Dec 2022 10:43:57 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame DF89
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1249092/67007136/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1009185319&ias_pubId=pub-4894209870857905&ias_chanId=1&ias_placementId=18336894882&bi...
https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}

17 B
465 B

7ms
7ms

Script
application/javascript

2600:9000:223f:9600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}
Protocol: H2
Server: 2600:9000:223f:9600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Tue, 15 Feb 2022 13:58:04 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 98652de9f742fc1df9de714d921e14c2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 24895725
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: qoCN7qI_iXoY1wpjQu7ThzR_29PEJ7i7bJMlTTiGNPUm6sgLaoyKZQ==

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: app20.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame B858 91 KB
23 KB 8ms
8ms Script
application/javascript 2600:9000:223f:9600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:9600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 98652de9f742fc1df9de714d921e14c2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 6054632
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: MBkLwCWvbd1qNLqoxJaa-9LNozGT92clH3bAUeHvSe02rwzfwjQYgA==

GET
H3 200 css2
fonts.googleapis.com/ Frame DC13 4 KB
636 B 19ms
18ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c2777526a216d9692dd29697ebee7836fe8ae65f3a290faa20b75b64c0625205

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 30 Nov 2022 16:15:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame DC13 205 B
229 B 8ms
7ms Image
image/png 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 15:10:54 GMT
x-content-type-options: nosniff
age: 8154
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 30 Nov 2023 15:10:54 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame DC13 604 B
628 B 9ms
8ms Image
image/png 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:01:15 GMT
x-content-type-options: nosniff
age: 1533
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 30 Nov 2023 17:01:15 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame DC13 19 KB
8 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

578d39c8cc926851f5be1195f339d26cbbf239f2f7cac8b55b349276514b85fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18275
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8086
x-xss-protection: 0
server: cafe
etag: 7427986489964165156
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4E3D 624 B
242 B 47ms
47ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMel4gIQqqLI1AMY6sfy1QEwAQ&v=APEucNVmIdaHwPsr2TwkWJyla7kBBTRKPz8o7VAtcj_OrJs0uySDaxV1dLwqhAcW-iZLEBT9rTEBhfJdo8oiZGu5g3n4RlQo72x_YJG2XoAVKlsBd0gAecP55rRvvyrGWH7ajpNTqIo2DDhWeXXU8sf4TI41aTqyn33g6ykBrck1i35Nz1aKrwY

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 415D 97 KB
37 KB 67ms
67ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AoOy8915xOFZWL2P1Wga0h7X1w3OuEFpn8qpDVhxJAnqe_c5-VGW0J-u266B8Tf2koMihuync8pTO3huU1m3qPqB92l22sdNEcWwiKiQJSsocr2kMndYzpUmFzZvsSrg3-evK7xBUDoOOGEO04i7GlVSIX-f4CUSqhYf6vrfgCTfyXYmk&dbm_d=AKAmf-BtNYj1BysUOk2DNyiYCc6Yo5FjIv1xlf8Z1ZPzXDqkROI6Q5fAO8mnbf2MS9395CAzmtLnjsx9P3_No6alTfDuzsS665iudpbMtlaHZerrGNlZHtmQxTGOQ6K6nitPL7_nLt7PYRXFGUWoPCfWJtwt20aBMPeaOcP10drZcQWlgaUfhe_zS5mst1XqZAFdsQIAJLtEtb56QfcpSI-pz_d681C-tgOOPLnZHPV_gt5UvVNgwgBlTejohjYtf4kGvm5V7yP_RmQTPIHFRf3dpO2Ye8cQ9ihfWtajr38SmuGnInV9UVPipXF9HBLFCtITziaKc7D9PnR3kJkIY94QmzymNCdRRiLt2QzQjDtYhYG2QMZtzSMQOtH7sQouBGQpXsfL-pwZkTfrzGPEfiJIq1PCYSZ9r_lEQWvL1cJx9Zb12m7LzSkFKskiDIACRdu5wmqsAUcHaEcDpOHpq2_KHkfJl6v8x6y2m0rSL24qt94h_WXNaNAig6tnC7WwgWtg4c0IgLbaQzY_u2aKolplWVddlBsSDBYVsRwSG9F3OGdYKkrl2jszU9oyebSzbFn67U4Mr7eT0WOFrEGkPRHiod3ceN-_C0TnJCmmjW8w4hbrB16ZHuiRuYm4-Ba8PsDl1vn5Mh67bdampAn-JPDcqEVmcCPEWHt3nYMpSrPg60UPbVgg1nG3QpvYlksMuM7RTCoLQtB60-Q4vYqwQxasfNa409FfZxPnJz9ib6ZurCvI0nfOJvAa4xAKPPANHQyZ5MUjqqlOgfUsa1YZjAEWwTeLfXZF-YqFFoMqApqpIXQfPrKWtK4cJggDQYfIrMGMC3TaKqduIXc0jU_K1A2W5ZwEspg056BgHoxc3P7j-qk-V1hKluwqcz01Nyc8fd4HM53C0saNrOj083cQdnh-sS954LMQrovmUTcybGwn3R-_di4oRX06-N-4-ThZyt3kr2UjtrbpwGY0gEoNeGesJnLUVfctmJPfyC53DFhn0G6WWwFi45jVwPXiofJFNTSQav9xodPNpfggobroURf9DzP9NZ4I5LnrvR57W2yoqk2emd4o8qjIHopkYYEpBaNPp4dNI65IUv-Sw4dqTRSfNjasI5OYExoXPGpZvzY1BWxP5rwOH2VnAHL-LF6n9L41p93dg7-jiOYprhH8D0ZbK2_8qHMLTD_lOcUgVOW6tDaefcQYkH2Ov24nC1bKP3Rd_S4T4LJgizR1E_9SIHEhny9JmErGnv9a3_1RbV-fpJtxCC7FfVnR-N1ocTvfuIz-E6JImeMr-3TlYUWMNhfd3GiNFGQOj94SWjtbOADtXhgskd2tQdO-2tjOjVCVQXbdZG0tKMzd1ibhchyE83c8pYgIJ69mvBJcDq_YSCk7NJSyu-VFFFPZSycpFmSycA7byzryo2bgZEvyhNxRvZBRRd_NwVjmgB9lqcEqRoOlI9JfHjOK54tyRc0FTBI2teaz3q9Lyp-MX77hHuLD_B3nOsjwUz-ukVNnImnMFrnSTARJeeo4kQvrm8FU8kGACtcjVIQdOVJxdpsqkdbuRYZ-3gVl0Qvy76wAhChTkq5tQLLDVSPAmIh0PzHroNcJXfGD23cPlW02oJSIJnJ_RkBJsp2lrhV-Ki8gbRet8UHfvFguVfpWnrgs3c6Obd_USBief-1KMIlpQoK7PWXryavytZdKR8RUwyaQis-jn7eefMz6PGBsFXTsS-d1x3KeYLtEcmw9OMWSG1A-2uxYe_sD6yHxLGjuG9juUXBKJD9IuFaHIiycLUekLYTbIxt7OUFKYfjtdWHimgvm3IwQ0qSTgW6eA_n-9y8GTXB5L8baTqXKb2nMYXZ88rzItrHh2anuO3Xv7o-pRtb0JEDDSaHgqFJndsmDh2MGbS1AQtrS3Z6dZ_iHn8lMiiFociLAazprM3QASs8J05098LytKOzprCQHGXT2Jz_489w2s_ha7vSuRhIwXqGJWw4R7CkA4e9V8S03l-meDrnzLDxy_WLYwRGqGtYh07Iky9JsC158DV49WSGTlFlQl9mM-BsuxEEmeA_eLjU5vxW_ttB4lq4X1u_HNlVyae3HJQ19a_PMf0gkKgpwskyhd0bbcneD6dWjtl1MxdcTBYclQkSPx_X30sQo7fxeT5haYxN9-bpPxFEJYV-4x2gJzr_MLO1QjR3I8BRlJUeBq19K0S_kIIGxrlTyy9kSFzjGmTfzUuCzzEXaieIAwDoCdoGDZZBnkY3mqK77I3J7nvoTn7YT2ZK7NILxwxL8m1VE8ToVAcO_Q678zv4MuRdfiZ2txGyXp6ezLsIoOGfeOibEu5WgnQ_O0Y8o_aSJTQRNHVa1ylTkJIJyrs80kTS-MzHpyfGSer7woFMt3GDFtOLayfG41JHf6Ty8qagFh8YBvtb5Yltg2pwJRKpfo_svDnfp7EoNv_9BN0YywyfSsSru6A8MN9VrLQrnr1mHnN8W_11hoKWxtRguUbuW7mdeOX2PN2fYlZicJFbng8GxPRLJ-XtvzhUo0DnpErnFpol2BDpjbR7--oQ16O7G_Iz6A74NrSkalKrZqnsDJLvvgRyjAPmwRXtrb6HxCDxRLd-vgCQwWaVV5OrRqfNn0KjpjSp3M5CBS-Qc-Y3MjXKEGneVm0913GwNI62vtmGZv8AwlBhoS7AoYLqyarD_eHOUwPpat0BzdVz2Fz_Fy1jMLuImHxlqVmUPFd4MjidNzOopHE1P-ZKp_0JwVdUYGdi1F2xFTH5OUKz4gHVvxlgJUs4qiRkjvmRPF1DIVJpuy8G2zLB2KmVi6FEVrO8UhVh18DI_Th0nZRal60sE4vX96iB5YWGS2cV25X-A_5VBYaFqu8bYjEtfgfRRYzL2U5MoTl8VGqR5E6wbr88O66RMzn0Ne9ENw2ICOzpGBFoABPYte9AYqkgXZYw88E51IGw-sc2HR2-lYVqYQvxVxtZaGLOR3-d3aZkGpTax39QoJqZ4ViQWjmjome0m2pm_DtL16r08SnIYkwOGiDQJtrvlaV9QdWFzMymbWrfw7Xn3wXMIjqTde8Ydo2aZBEtwk54i2a7S95DS4BN-X-LQALD8Cc4qu5-94aKmiVNK_amMg1W5A1YXH6KIAYVdSF-yHGQwKkYXBVhof_JHfR8eAHZU2403QAQMGa-UVsWrCFA7TiuE1JnxxpLBnd9CEBVsb_-RSuhmWiapQMZ1iWFrfHFzdwB48war-HOHZQOerrm9qMkTpDWTMOz6enYzVewyfyhOPpNfwjFzQ1HTFxsyb-zLY3V7NF0tfosIf-SuQMCbvkfB_hm9JW9wHFQq1jXy557X5-kNeQAHSIKFWGvuCLOskS6DfyDQ5kYGN3_JHVbZe_CmkLfWV5I-4Y0r1U_sK6ib3pbmlRVJcYpxO_e4TS1zYXfYoMfXKtpP0ml7fa2RwNQQ3hRAHPgIjxgigDYaWcgmCRyr7TVZVe5xYH0q2MKZc9lZTq3XCaE4JOr_cuOe693p_5N4HyX4ca1DX_2_qGZoXmvyyNv8S552JCzAJF-jNTiSBjYMCTmf1E3d4liikN-l_lu_72OOiw_05W6icYqaszlpphZKokcmSivShVfycFkumM3b1KiYqKBsmjbtO1dxdGADReAIUHzAwtjyZuGeQ1L8r1NO3igpK78bbl_nROjvuTsXmP494kS3stl83rmALgxOQV7yR33KzMWShy-MYhTis9pevf1rDXoH526CM-K6ndaquY3cSlsOG7BQPHnTfhbrp95aNLulXCpc9D42u3sy1h3bgFEgL7Y0CfK83UabjopbYOPJYupnlyqvNlCrJefabnFBLcjqoC1uBeXcKTYv094e0yu5oQ0Hjx79VT9IlyBBU6iLFP2e9QN6iFvMbbRjpaRlf8FePwD5Gbk&cid=CAQSKQDq26N9bRofZeps79OrLCMxS6XPPvzpt89f3b9CtQfSTZfGJPWpikgXGAEgEw&rfl=2%2Chttps%253A%252F%252Freceitas.ninja%252F%240

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c0c43357853877bef2e8ea41ab5b9d91ec76f991027e2f1c4a421f2f399c508

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38144
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 415D 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1702
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 16:58:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 415D 18 KB
7 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18275
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 415D 0
0 16ms
16ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaScyQ83LTkVUsY9PoC01JRqBkkalhwmznY_8ZOJtLqwC_zCx-1mEpN5ta3xKx5XlvKcJZemnJhr4NdBiRXt0eYDvYSCtw
Requested by: Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 415D 154 KB
47 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 415D 42 B
63 B 42ms
42ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BRZBQuI5T0IYqdqAefufS448pte7S8IkNVOB_426f6O0VDty5xXx-GjscUnj5Dihol5jK9HZVhPD0Uqb_5oAGzNddYOoE71fSlFtFkk8YJ0XIwLPA

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DF89 43 B
216 B 294ms
91ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1249092&asId=4a8b93a0-2aac-8809-47b0-35dd7a603f1b&tv=%7Bc:vtmyMO,pingTime:-3,time:207,type:v,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:129%7D,%7Bpiv:0,vs:o,r:l,t:206%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:207,n:206,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:129,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B89~1,0~0%5D,as:%5B89~300.250%5D%7D%7D,%7Bsl:o,t:206,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B0~0%5D,as:%5B0~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18*.1249092-67007136%7C181%7C182%7C183%7C184%7C19%7C1a,idMap:18*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:130%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DF89 43 B
215 B 293ms
93ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1249092&asId=4a8b93a0-2aac-8809-47b0-35dd7a603f1b&tv=%7Bc:vtmyMP,pingTime:-6,time:208,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:208,n:206,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:129,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B89~1,0~0%5D,as:%5B89~300.250%5D%7D%7D,%7Bsl:o,t:206,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B1~0%5D,as:%5B1~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18*.1249092-67007136%7C181%7C182%7C183%7C184%7C19%7C1a,idMap:18*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:130%7D&tpiLookup=ao:receitas.ninja*&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD23 0
20 B 45ms
45ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B5exhV5KHY-mCMa7H7_UP2IWGmAcAAAAAOAHgBAI&bg=!VlWlVRHNAAbvMpMzzzI7ACkAdvg8WvGzalZpZHROzA2_zzIlHb45Zr9L-e_ImVxJf4bLHeIwZL8b2gIAAACJUgAAAAJoAQeZAuZ-cLU8DAth_ovzg_v3Pu1v9r9C7ygnLvE4T1TlNzSZhDzAhS-QdclK5sZP9MivuYo3u0Dwg1jRBrNnod-P-m09krHHrhgroLoRvoJmuCLKG-8HZrmX4puTFxPwUUZ4YstZL1_PcIZitSUmRpfaugr--QOwp1w57RKh97vz_1vX6L3DMLMdCl-FnNkkjfHjP90d_fCl1i5uOl49u2ui2O4QQMoJhYt0LB_07o32POa61Z826OiEsKus0jDEWeq1cZk6PQkG85ToFj2JbIAF9cpYOq6hLMNyE5J5dhBgavxfFzKe_bKJ7YsG3Qw9NZRD7f7XMj_Myh6B0pNspRkOcz38zrhZwGRpS8XcfSct2lbmIRV-7lbVBpGPTPBUQLNzwOCSXWXeA4tjRM8_fkE57PBUc1xXUU922crhaUcXEriIebBK3x13R2JKfSP8MgxzgeRw7SxlwUvd-XqQsfysf-md-GhGdAPMM4jxc0te-7kX7GhdN03t9WHW360LaCJ41V_vsm56caCgzMzxxKWhLdxUJfpA7E8jOnlrSbDn1KnrtQ-NRfkK31fWw7bDDwjP7ahHZOdni3CVlOV3CDKEmIPNt-5N8ZlJHtj7UX-_HudQZJ3A2U1yMtXQ0nx0pJBuTW5v89u4Y7GzE_UXlCh0ykJYMOlH2UY7NrVUNuPzpyHoMpS_zn53g7pwxr5hm_Y1xogUSn9U2IPqB2AadGfva_5T7n8rcNdnzEkpxdMhmssL-572ALjF_PKJi0oEWeqrclH7YORrWaY1Cq5OLN1kg4zjm0zUEPue2gdjJ68o6tKuhETk39mi4V0fR_XJ5YHYu3rnqyc8ZxST9qXoy37_lOazHi95lH_sF_RV_TVZj-juyx9RSb4WTsmOFwRUsXfCdmBsec0r8o7lxZohZQtIZqY8VGOsBSYpZ0P7GqB3JlZ2Qx4ZAJ2Wu3JFDSFAo2wGAmT-0Olsbniy7QXJFZEnSQGKIu-iV52a

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 96D2 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022112901.js?cb=31071038

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://receitas.ninja/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:46 GMT
expires: Thu, 30 Nov 2023 17:26:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame E9B1 7 KB
6 KB 52ms
51ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05f6c6cab89b12c2845a82398946a4da9d6c143dd1ae81cd2673483677543500

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5706
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DF89 43 B
215 B 265ms
92ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1249092&asId=4a8b93a0-2aac-8809-47b0-35dd7a603f1b&tv=%7Bc:vtmyNi,pingTime:-2,time:237,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:500,beZ:501,mfA:616,cmA:617,inA:617,inZ:620,prA:620,prZ:626,si:631,poA:632,poZ:644,cmZ:644,mfZ:644,loA:709,loZ:711,ltA:738,ltZ:738,mdA:502,mdZ:556%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:129%7D,%7Bpiv:0,vs:o,r:l,t:206%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:237,n:206,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:129,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B89~1,0~0%5D,as:%5B89~300.250%5D%7D%7D,%7Bsl:o,t:206,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B30~0%5D,as:%5B30~300.250%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18*.1249092-67007136%7C181%7C182%7C183%7C184%7C19%7C1a,idMap:18*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:130,sinceFw:106,readyFired:true%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 poster.jpg
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 17 KB
17 KB 10ms
10ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/poster.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de608f70b0878af0836609d7368904b4dee70f73d0821e3e3f56d19e22cda466

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 23:03:23 GMT
x-content-type-options: nosniff
age: 325405
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17701
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 23:03:23 GMT

GET
H3 200 play.png
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 893 B
920 B 13ms
11ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/play.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1d986ce189291207358a7d6a742dc1a195412ef31296c0f5435cd123844bb97a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 12:02:54 GMT
x-content-type-options: nosniff
age: 451434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 893
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Nov 2023 12:02:54 GMT

GET
H3 200 replay.png
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 46 KB
46 KB 15ms
12ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/replay.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c813ba19d4942d1185bfcb0e4c9602efac4c8d4c9e8b6b3da0592274e92f20f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 02:34:20 GMT
x-content-type-options: nosniff
age: 399148
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47113
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 02:34:20 GMT

GET
H3 200 pause_sm.png
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 37 KB
38 KB 26ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/pause_sm.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

476b390b7aa9f622db8e98c9968dce12e62b42f283b0c53b8ac256fcff2a2c70

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 12:02:54 GMT
x-content-type-options: nosniff
age: 451434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38380
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Nov 2023 12:02:54 GMT

GET
H3 200 play_sm.png
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 41 KB
41 KB 21ms
18ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/play_sm.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e99cf754d6a9a51c2338ebe4931aedd94dbd8ae774a5ebc37a13f9bf5ef89f2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 23:03:23 GMT
x-content-type-options: nosniff
age: 325405
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41498
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 23:03:23 GMT

GET
H3 200 audio_on.png
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 41 KB
41 KB 21ms
19ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/audio_on.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68df6eee66cfa30a82cc7e3518c54cfaf71019606d217f56726762837fb0c9c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 12:02:54 GMT
x-content-type-options: nosniff
age: 451434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42379
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Nov 2023 12:02:54 GMT

GET
H3 200 audio_off.png
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 45 KB
45 KB 17ms
15ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/audio_off.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfb7eb7a771ba27f5e9aef777ce9f284014e6d818d9cfc6433b77a34aef818ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 22:36:05 GMT
x-content-type-options: nosniff
age: 154243
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46241
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Nov 2023 22:36:05 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 5 KB
5 KB 36ms
34ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/cta.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2def1e48726b24aa01165484ac75d08c539dc73a5f215900cd0e5a367bca033c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Sat, 26 Nov 2022 23:03:23 GMT
x-content-type-options: nosniff
age: 325405
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5431
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 Nov 2023 23:03:23 GMT

GET
H3 200 finale.jpg
s0.2mdn.net/sadbundle/5916458164949993969/ Frame E9B1 115 KB
115 KB 36ms
34ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5916458164949993969/finale.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e1fa1fc65430f92e2188e44f7aa2aa7f406294b5e98db1274a41ed19f0c2ea1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 12:02:54 GMT
x-content-type-options: nosniff
age: 451434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 117450
x-xss-protection: 0
last-modified: Tue, 25 Oct 2022 12:42:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Nov 2023 12:02:54 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 3AF2 8 KB
895 B 19ms
19ms Stylesheet
text/css 2a00:1450:4001:809::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a84fb0803620acdf77c0f41d652eb5538002ed610424bd0be051203ee50cf940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 30 Nov 2022 16:12:16 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 3AF2 2 KB
765 B 24ms
24ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 11:55:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19893
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 11:55:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 3AF2 23 KB
9 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61651edfb03aae1c1007d6741f98171447ae7b1a67aaa520d8b0a959e0400885

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 15:06:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 8407
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9428
x-xss-protection: 0
server: cafe
etag: 246362764157784863
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 15:06:41 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 3AF2 3 KB
1 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1702
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 16:58:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 3AF2 18 KB
7 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18275
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 3AF2 0
0 18ms
17ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRTQncZ966w70FZ24rMnLgIRv9F_UuTKprsEFvfR6N4bThc41L3m2Sqk76m0sDHXxciD6JGpzo3svofB0dkg7yNl-jMAQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3AF2 154 KB
47 KB 79ms
78ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H3 200 f7733d2b54a65c984752ab0a98c7def9.js Show response
www.gstatic.com/mysidia/ Frame 3AF2 34 KB
14 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/f7733d2b54a65c984752ab0a98c7def9.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d028ff06991dab0e77014a91995a9c0d6672a90e68edc339cd62a566fe361ace

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 15:35:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 438663
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14118
x-xss-protection: 0
last-modified: Mon, 14 Nov 2022 13:59:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 23 Feb 2023 15:35:45 GMT

GET
H/1.1

206
Partial Content

file.mp4
r1---sn-4g5e6nss.c.2mdn.net/videoplayback/id/982372acd8702c28/itag/15/source/doubleclick/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1701365207/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm... Frame E9B1
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/982372acd8702c28/itag/15/source/doubleclick/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1701365207/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signatur...
https://r1---sn-4g5e6nss.c.2mdn.net/videoplayback/id/982372acd8702c28/itag/15/source/doubleclick/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1701365207/sparams/acao,ctier,expire,id,ip,ipbits,itag,m...

498 KB
498 KB

55ms
9ms

Media
application/octet-stream

2a00:1450:4001:5e::6
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r1---sn-4g5e6nss.c.2mdn.net/videoplayback/id/982372acd8702c28/itag/15/source/doubleclick/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1701365207/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/56789D17C7B8DE6DE6BCC2E95AA5FA71E30262AE.02A376ED99B7E55AE369EE07C22D7F5EBF05F06D/key/cms1/cms_redirect/yes/mh/b0/mip/2a01:4a0:2b::5/mm/42/mn/sn-4g5e6nss/ms/onc/mt/1669828454/mv/u/mvi/1/pl/43/file/file.mp4

Protocol

HTTP/1.1

Server

2a00:1450:4001:5e::6 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

6910ae5fd0d7838d8f97e4904acd328c036f6fb9a473a89a5914cb5a1aa9d2fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date: Wed, 30 Nov 2022 17:26:48 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 24 Oct 2022 14:39:37 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: application/octet-stream
Content-Range: bytes 0-509471/509472
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 509472
Expires: Wed, 30 Nov 2022 17:26:48 GMT

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r1---sn-4g5e6nss.c.2mdn.net/videoplayback/id/982372acd8702c28/itag/15/source/doubleclick/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1701365207/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/56789D17C7B8DE6DE6BCC2E95AA5FA71E30262AE.02A376ED99B7E55AE369EE07C22D7F5EBF05F06D/key/cms1/cms_redirect/yes/mh/b0/mip/2a01:4a0:2b::5/mm/42/mn/sn-4g5e6nss/ms/onc/mt/1669828454/mv/u/mvi/1/pl/43/file/file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 641
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4E3D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1

43 B
766 B

9ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMel4gIQqqLI1AMY6sfy1QEwAQ&v=APEucNVmIdaHwPsr2TwkWJyla7kBBTRKPz8o7VAtcj_OrJs0uySDaxV1dLwqhAcW-iZLEBT9rTEBhfJdo8oiZGu5g3n4RlQo72x_YJG2XoAVKlsBd0gAecP55rRvvyrGWH7ajpNTqIo2DDhWeXXU8sf4TI41aTqyn33g6ykBrck1i35Nz1aKrwY
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=495
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4E3D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1

43 B
766 B

9ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMel4gIQqqLI1AMY6sfy1QEwAQ&v=APEucNVmIdaHwPsr2TwkWJyla7kBBTRKPz8o7VAtcj_OrJs0uySDaxV1dLwqhAcW-iZLEBT9rTEBhfJdo8oiZGu5g3n4RlQo72x_YJG2XoAVKlsBd0gAecP55rRvvyrGWH7ajpNTqIo2DDhWeXXU8sf4TI41aTqyn33g6ykBrck1i35Nz1aKrwY
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4E3D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMt8pHUymqn2zhLnOzJGV5s&google_cver=1

43 B
1010 B

13ms
11ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMt8pHUymqn2zhLnOzJGV5s&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMel4gIQqqLI1AMY6sfy1QEwAQ&v=APEucNVmIdaHwPsr2TwkWJyla7kBBTRKPz8o7VAtcj_OrJs0uySDaxV1dLwqhAcW-iZLEBT9rTEBhfJdo8oiZGu5g3n4RlQo72x_YJG2XoAVKlsBd0gAecP55rRvvyrGWH7ajpNTqIo2DDhWeXXU8sf4TI41aTqyn33g6ykBrck1i35Nz1aKrwY

Protocol

HTTP/1.1

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
AN-X-Request-Uuid: d9d33509-9614-4613-82a1-a25291d8f148
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMt8pHUymqn2zhLnOzJGV5s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4E3D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
AN-X-Request-Uuid: 0258e9b4-c8e8-4327-9eb3-73b470d43c4b
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 75D5 624 B
242 B 52ms
51ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARjZ5uzHATAB&v=APEucNV6O66fKlYszBdQlwg1tR3K45YiaEK5Fb-dbwBFio1l_gOLQvmj06Fzz0keHhhPbVCENOXxYxGea4XVLFYtIDV_uqeHlw606oIFiQbG2V8hRX8u4q3XhjMUc8GzPLLsTqSTa0F6DQYxShWiWqcLuW_5HmjL-vTgxVVb-4GX5qLBg6Xsbjw

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D71C 15 KB
11 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A7t4COyvYxTviZpaAgsWreNqgQc2aFSqAXd5hyOoxROVP_nDFb8XGsehheMVctUsyNoKIn8N80vrGcNNPWRsv_DngpXMli2BCnq1Ilt3VbTfxz8inmKrlyyfgRLuCSrRRACPqmWnJU1rn7m6QjtvanaFpHR0X8SmTXp5CSm7K48Mkw4H4&cry=1&dbm_d=AKAmf-BRmxhyjxucGwXH4n5nJG2zMBQrEojRt4js46ZgkGV2lvif7EQ99ZhbZ9pnlVFNrIytMVzl4izw5yfBW-rSWa1dlKOzufAlaDU5JmI9v4UfnYAvf2WKYx3g12D0x237rjJ3EDEkHW9bRh8gHnUREzYdB32cE9UgFCWyjfnYaez8jZmdMw8oq8GLfcl_-sOPC2_MEs8l61JGef_T7S0ubDQYThdciUGO51k44XHaIt2xNfkiGh6c6oAI2ZpJcl9W12juvZZswtgiFjUEU9FnB-dfn0hr-4Ch-ran6AvtgMqMvNJ8qUm7SydM5_iXJU8JvsJZPki8sK1gQP2IC2gYklaGJOM1oBGgzZ25asUcwa4r-RCfMjVjqS6ZqS1J-uMawtvG5qnzg7Iv_LluF4r16aVhG4XHtCLyr2Fe7Fu_tpwHQfkC0arW7ku-6knWz1YGV-_QpFks5XUV9lYNB7HnGCLQ9QMf_6QOR4j3xvuBKG1oQNDKb9izQzy7BaHpVnffik1lzUfGMMO_EHmSSMyemHEPe33husaArH5whOLWDtJWsNTRx5-nW0Woo-yGGomvjJL9noFirNolMoT9vE3Izv_5dLZFKvdjERXozXZ8G2kJIi1N-Ng6zG0oQTQAjZ5gyN_b-eyR_fepXtoB7xQh-cgFDP2dsBAtFbf5SZEOrTGf0IsHEWcOGFKw41yTthh5Q2KNqeMLDoMOMuuT2cMLYEbdVFZJNh9Yj9onqjK20jDh7NwvxRCSh1cs5SKMK_UcXGCcz7oHuFwHEwyZG_Ts20tXJEPH6fJGWc-W-kFdjSze0uvOHGL3VrVTPOqlche9uBEHlOdpFKf5RqY6RRD-XVuUd4X28bHZxPbJwRHZyUBB34ai4KRu5vAcg39R0xP08t-ZAvO1OYpfSVDKYEvFc_tsy_SnQnAtbsLkyCCOJxyYDce-6DOiKxPmsU6If8MGdO8ojpciS2vxsft-0-JIfsLVPLCaR-w3SPoyy1Xn26Qdr368F5Cqmuo6Ma5hrOAsyyPMUtxtFz6t2OYEFBdDJgroA88N7gHOS5yFbxEhy2JuWB12rByBJWyU-x2xMEMlmBZluw5lOgCjihJ1JIBFsgfd0-vXGclLAdreBivRDzFJAKTgbHg_zOl1ycbOLrzzTOpYSdZAa2gva9IzHg37erP-CV0Me1OTH8VzwQF1LLsquW31lFYVmZNcTPrkA5grdT7FzPAVWKWOMqdrmG1sHTANWJn7inMw-0x7d6r3r0HeGY1JUP0qv-JEf0mERvB-Usx03Gf8kBxsCDZvUr3HeswnQpT4UvCe1TmHWQCl4XpE3FO6CK4B-FONCQRR7qfprV8DMAft_QHAep3ZG6lL4z-MtMc2dqQWj08YeX9gii015PoILqHA4oSyU3n7j_8r4LuSw0asyXE_Gu8TZt59H08HCQ8iPBIv_wmB96o6Z-evV0gRo-JtgTc1-BtgOPyffnCQJkvkWrXd7duYL5aPsrV-Bm9sy2YEyK_EbkOaEeYC7PjFRVg8GPKtHgajVRY8Xt6r2XHftKVH7nyNNtn_X1PvIPgj1JlbaNN08vU-FOjPZ5-G8EdgwkcCXR49ylo7tIxoAmUs_MVVDaxxiZCCOSCIOyJNGoj6jaKO8lT7XmCuS2QOiOXsrPNBHMBxApRuzs-jf4xNpgqfIwWFUSdMibhbmusPVniXu_YZlzEFKvGd-LhL_K3Y5BUYDx1r_XBpEGqjP7bySbDPPZcEDDnDLrbbYZ1Vti1bXamedRlEIU3cIOtItWZvsJc7Uc9UvsdrfEraLo5Mu3WsL1vhJD-lXGmwCNKA74rOXu_v66uq1Bppo5fnFIF7GrZz493CP5x724hj3raKZVJfUZxOVp3PB3LMCDWGX2_bju2DHRMyUrgDaNCW1vSuGZLt8wqtNC_K8YMKofctI7v9ezVM9CX-e77SiKF_6zplopUkemG2kpbVnZrOmLk9Ym-7YTDk_pohYk4sGnP-44pOKrV_J6nVmoyb7hQxviMHCRcLgcesMZNjrD1n37hDHNBUj7lYeSv3eshYu8zL2abrIpAXApOAJybIceJ4WkcKKEt3gcSiZMsTg9Qo4ODWXJHrlAZxllLWM7BEiFIsP0ofPZ3nExdh45flUpCt-KRR9KJDKL154ZJrwuU9-XDvKePrLDYbEjmKoou8qRQaq1Mh3otxVQZU0VcxdoKPPizJXn914Lg-ZsKdr7RgrCeWqbf_JRxCJa4348BNNVpmGc7fP_PYupbUyHr6Ba5CqOBWeaoIfRPcd0AlFUKzeN1uSrwMxNV3vRWTUtAj5kreMnREanBap8KAwsXGzTzA2ej976snUamTZ3WgssSp2-t-yrMg3cBRjYyxt8v_418xUjW-xenxd4IaTkR9vk4hEdkRZ42irFV3Ko3BzaXgHJRtiN6vmmSzNXQZ1X_Cp4Ocnu14hGynbQuQOQb4lIoLg0R6C7z6kQE_CCHBY06k9XE_R4IsOlIRs046c-F6MFiR6g8cLaDLgINXQcDeaDXebfJ3coRK1_FQBKC5NgBrDjWTqjq9_zcjdrnHVc-XSHzP1kQ-5ue6E_SB9QAQCrgvK3fy3qiz0YrPqZ0iZdjyvkmyRA9GOb9f3JnrtqZcOfKJMOGzmCLvRGgS0idkwIoYsF2-eqyx8ZIlimeNgGrl6Yf9v9Mah_FeCUcuqz2VrrM1F4ILapLg-MV9GSE3G7fJzggNKlMhSvuSe3ZylkovpCA1w3M6gCfENxBkFIW8FxmyMS9ynUkzOoMxsIdgzsE11SfdLM_gTx9zL3tnPMg2KueiyJkOsCxlhRqCSyOrq00Zh9ordnkrlV9H7reD8ONSlpVtrDz_8707HgOGLB_l1_5e6aTxyX5WlIfzQiNVKHdlJpXyPhLITgoHwZmy766a3ZGpYeMgduoyA0liD8gEO9qyyXr0VvD0NNhzZ3rejuDm1NuKVj-QL0nbpeSy-6QYEk_1DYcFyxKHBORBQ8ieouJlNZPxAL2N_Un5B6s6YMNQhQRmFJB94EjuERPnCF7cs5DFn-S_vpffrJSb6O44JpxHD5kBSKYKk4Si97ouvefTAjijUfwAqWuO5I60hY7KS2jN3zQR30VJuI8jyifF7zHC7xgUtzzRRXoPfdXKaiuP&cid=CAQSOwDq26N9H0ALsFVOTEflyoM-eJGOY3GDfG3SimsxRWWMp9p11g2Dm4JfgrHTlws-wVEe2_pjTyUtlnGIGAEgEw&rfl=2%2Chttps%253A%252F%252Freceitas.ninja%252F%240

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db14ff23e6a1f3450102aea8f33ade9f18ad1d829af2dad716dbf9445eeafcde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11226
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1014661/62144026/xbbe/creative/ Frame D71C 245 KB
74 KB 41ms
39ms Script
application/javascript 34.251.222.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1014661/62144026/xbbe/creative/adj?p=APEucNU6xfUmc1GtrKvvboLbchcZ8tsjpxoU4ApKKhbWai91U4Ug7sc&d=CokBAKAmf-C91oKyjQrA6A7zTcRu5GnfVkVlwheRW29eSImhdd6sZ2fqHwgCb2vXBQO_7U_CgKFGUmnwWta4G91kWXgqqTufmKul2Vujzw1ofiU7g8vhLXTiFlcT-TWkctrrX9ZOe3KbgS-ga8AByV05KGUE0RF109wqn1S1KI4mruHbPMB35kInzJISiRUAoCZ_4HmnWN6KulTZRPTcGlM8KRZUuwN-dLrdwi_2gXCZ7sMhmcVhmN7bgqQuQyeEREveeVkie5WcB_QwGgxyYcSvjfT0AKmnoEpClPYLZ8wzq9M7I0ztNKZdGIZS-D3XoMF2YgEdAeVJyDYjIBAa2PKSEvrIglBECn-Q6VLpbTYnaFzyjhYTC5nkmO37_xHcZ59StniLBWSYquiB6zh4nWCuZHe8K3wkXAkzmVezEW3ad7OJMAbNE8kFYl5RrB9R0aLypvjBu_VcSsNjnzaT3TecHLT8UvaH4xP_rCdR1WkZcVDW0Mbkx8gsS-k2K74DSEmhuzoLnZUwFx-JIbMibf8Rz9czWV7gxvXl-BphypNnoRgmYRUuOpsMbiLGy2riTQriO2umGqXTDMeaw0yzul444EsE1L_hWyidB6frs_JDfhEQMf6jO1gum274tsRt2CJxxqFJrwVA25qnWpYERKkBmaSKeqGONEp0mcTw9d2CES8iHJCfsW47N22OftOB5BLKdyWZX3ioYQKJjWZ-Ez4tx-o4cKB1fJcNPIMBJ2Z7kakfUQjU7K0srFa_0P9Myd6DOXHy7PWdJ-ArZLw1fzjcE6YtmvQI5J5n-5bRoM-xWUl0ujCkoDYrft6aFU3etGC9o1DQKU-LLPBtGsRLhqabI2TEAy0R1Y7pwJadNqjHlwBoKUn4ctfKfbEWAiuladQvbRJwQ-QfnKSaxq3skpOYGjxYKz4rvrrn3TRbtdxaXKKf0sdYJXO5sT1BBNF2r2Ri_2xXGU5-6avrjlCJ01BmIUrj_pGq3tGJ9Tq7VS7lIfDUIY8rmDO5W-BW_fmvphzfH53xqF22jypQbafR8htdlDMtE8TkUDE-dCcdZoG7ejcj2ifuI0ZGemfq30iDYmAbOKr-RHfu1fbnnviJ2C5poonpjicKJvH-tfSVzfCQyEycwuor4fp3vkPUQvr6aZIsdtbaCkH9e2x3EE20DPNR1w4m9b5AF8LhVW8mt8wD9CcVUBpXCBtx9t9pbHCMR68xAPotzmLCLkd5LlCjdrzhm4pb-zMreaAcEpTYZaYUXwICkogoA9NYaZ93ebobBZfxBLA4gdIRljaVwwyrJG4TCAxdeAeHLUmG5iS93fzucjCMkXYDF_bYZYgART8ZUnKnvn-tYr4CGew7q6OxD6wbgYieNA6D6Cct1GfLUZCct-PLggdH4Auoeuvbdjl93d1nk8TUyqYe758uiUa0OVh2JuQHNwJURuuQv4DJbKaibQGNsNSkmLEGBysBhv4ZF3Hv_6B5eobrFKx8f7c7nkvwwF27v-gildg0YiYM49uPLZ2OrSMuM_QZuvRjs4OXBiSC4V76Fo97vomp74XKd2ZNBBoHCfd5NjngwdBXB_9eclwVc2BeqBwFbbiFRR3pC-QPNI8UcZZs5Q9j5vPfL9dw3_rR2d-WuTy8QsPlgmmgPPENzVlclM6WE_uhapBApxBwnZn5KT30z0cDtV0OasNlnENJZAZAreYJurjWyZRzQalvrnmUqgHx0I7GWaDLF39kbHg6i1Pln3yW7OtY2_6UsR9qsVAHNQZ6YjHooDbf7pA903BEMwj833E6unee6U1Qi-e-ZnVYq6G1b4nC5eVo3m_LG0TZ30ftfI30QcDCRg79OIULchrcaybhP_2880DdqXaaYB1A_Yag8EKo5ZDwqyY-T3wJNw5j_wFD_zS2pfue14w4EJQzzRqfcjE1rWECRNCDejZX18AERRQohExAMAwb5L7iHxUUuQkaHh9IbHjV7lIVQ9-revkmir3d0x1dp7MsAgrkyaZHZwb7doW63pnkfmtgqwsNc2m1DNVRSr_L8hsxNNqx-yKAychi1UQne3lafWMDwQb2oTjHlrWp4dv7Zwm_qICaMO68MxwlqB8wEfABtL2cUlUdCfiB5MwnhAiRT6_JFgP-JGQyHNXslE36cfrI29wqvmrLKXT06Vs3X_AxsvqjF8qLj1THgx073qrMpJcl1tsXyEhBzkTQCxpuy90MctWJzGYYr9P7__XhXI8eq30js1w7pEoMPxfDda-NOQfw6jQhOkBRzjoG1Lr10qE1syMmUuWXL8cxueNVvl1l_ivtg_vbtI_UQ3qAXk0SpfL6RnJaDdFV5p7rsUou2kiviIVm9Ahfu_mHEvn0ffuzTOh906YjckusWatOxwvEjyjIGBCx9-BVz9Dd_0v3TxbYvPI-03kdb0nLoqB3UWDIkmOOw1CpgwCRoB7wdBfzMM-5Ud-mB3u-17bmMTFiuYi6rI6FNefmgQz-BMRUBOMbGQDDVZXo2IjWZPCs_3cpEEyo_mylzSpymdM9NV8LvYD9Kohp_O9xyijf22k2-8Ji25jAk7R8Wh-wefFgXCfubC037s82KNHlKNkXenBINmKRyeEfwapLJMRzgfVJ5K5sUJmvXR3Ex5Iq8JsQvH_Us9FSqGr4eWZW7AglAPPOb0sZq9XxE3kZGmx1P0KY4lt4dq08YlHHv_ZLdKgk6FZngNUSXfz8SKzX195bMl_6-s5jiCfdbmbYiU5YvtmvUY0_BeQi9T6-YuUf2nCu88jsoNx-Ad8Nrz1Iw4FVs_DtLCPwjW7e8gGBEsaIjAynvkQYSjieUO2Q7-vdS0Z2OOIx1YnyiD2zGKv1kTgkoVTDkekx5A_A-knSo13YjxOV6lFxM3SyP8lq12DEfMkMHOrj555QXk6XyAs-FoaYIacY6SKO4jkzhWCtxUgtmf9mYMy44AKZbgLdeF_Qaw6woRxgJBXc5TJWEF0T3v-hoG3hPwpAcR2FLDh9VMMbW96IOplBBdVm9nMckhhFDFTR_KZS1YCpRYM7u3GlW-kufqInW4gUbVxZO371MLAKxmplJFO8RSV681WEE9LzdmwXRhNKBUjHvDozgVrneirJzTJp23Oqv5Pz-CxUxivmUBdJhf1ZfiIXeGGvgVT2wzVWcUCziQQ3GvJyweLXbpBawm1DPtGdaL1LLl1bIPSMuC5zoaxd1Lwpp5Zfqv5s-EYuA2AzWBEtXPVZOm3WP2fLaV2VbNCWN1mmy7ZijFQvlDr2HrGqBqMMcDzCLcVK-MRUwFuNsfr4XWDNVb4YyXhKWBvoi7Zh_mkOiJ76GDtIfDjDMpKFj9JgE1oeCGtyWTdG18UYtt5cUph8iWvsqRi2kTYVJRGVGoQLHYul1gSmF3wz9fvewaovB-hhN5RUy1H0spj7bNl0GSzAvhq_KTzxcw_TXfcW_jJIDVFOQ4eP-18fbFecsXsZ8mxmbN3fADUt8eYPi9gOAXxGlqBVXAqft7xhl8whx_IKCGX8ye8gqCiHoJDdxhjbbjdcEd3j6vkHR0qpsBPPd4kLmVCsWNsQeDCvHlqQugIMmdLozCfusNP_-2jwhZHwNaJIFigyYrIkO3kggC1BE2XkZgnmNNrjgRxLriUByAtzxMjTkIBIsYfTVyWDpTIo-xoEVcB3AVJ7ObRVlXFGMGtLmDTvw6cni1nTMfdUkEsaQlxINE4XUuatGa2TxQPnPiqsjf5aV57Ov6ahMJ4xJYaT-iyU1Am9uNsBcT0DECAU8m-uxmI-gXNYsiEFuYP5Yat76zOv5i7O9t3Mx6YaQwgEEjsA6tujfR9AC7BVTkxH5cqDPniRjmNxg3xt0oprMUVljKfaddYNg5uCX4Kx05cLPsFRHtv6Y08lLZZxiBgBIBNgAQ&ias_dspID=3&ias_campId=28377781&ias_pubId=pub-4894209870857905&ias_chanId=1&ias_placementId=17455270685&bidurl=https://receitas.ninja/saque-fgts/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0io7Z9MSyA_N3TBw98j7F1b
Requested by: Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.222.172 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-222-172.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: a6ee315f6528b2566c546a27996e11be1b637f4140e239fe22692ce37f78312e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame D71C 3 KB
1 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1702
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 16:58:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame D71C 18 KB
7 KB 13ms
11ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18275
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D71C 0
0 17ms
15ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS0yyW-FpVXviEdcoQaMS1Egye0vSFCEO9lLFCYypdOoOkpLczpsyZaJTbeg5pGma4o5RnSyYM8gZB74bPfLI8A_aULRA
Requested by: Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D71C 154 KB
47 KB 38ms
36ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D71C 42 B
63 B 51ms
50ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-As3KWqEp-o4aUj0LVgBczbQT4-6ncQHxPhwwkvSrAe7nznxGIFbvVzj_i9DjdeFoeckvQJAai1mfoXlzl8xxZWfcbfcVjZTx0ueH-ed_Y232Wg7Ic

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1211316/66369106/ Frame 415D 238 KB
71 KB 187ms
186ms Script
application/javascript 34.251.222.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1211316/66369106/skeleton.js?ias_dspID=3&ias_campId=1009276076&ias_pubId=pub-3685392670532966&ias_chanId=1&ias_placementId=18642321290&bidurl=https://receitas.ninja/saque-fgts/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0izg-X9KlHQBRAwjqs6l0bA
Requested by: Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.222.172 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-222-172.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: ac8f2d2f9bc194110abb16c1aa6ef497a6bc3521d9e7a745e21c4cf19d668b1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 html_obb_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 415D 169 KB
59 KB 33ms
14ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_obb_rendering_lib_200_276.js

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd2056d3c5a5f9a087647154dc26dbed362a61b733a6cbc8d9e5330b4f4d4284

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 14:04:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12140
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60459
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Dec 2022 14:04:28 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame 415D 8 KB
3 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AoOy8915xOFZWL2P1Wga0h7X1w3OuEFpn8qpDVhxJAnqe_c5-VGW0J-u266B8Tf2koMihuync8pTO3huU1m3qPqB92l22sdNEcWwiKiQJSsocr2kMndYzpUmFzZvsSrg3-evK7xBUDoOOGEO04i7GlVSIX-f4CUSqhYf6vrfgCTfyXYmk&dbm_d=AKAmf-BtNYj1BysUOk2DNyiYCc6Yo5FjIv1xlf8Z1ZPzXDqkROI6Q5fAO8mnbf2MS9395CAzmtLnjsx9P3_No6alTfDuzsS665iudpbMtlaHZerrGNlZHtmQxTGOQ6K6nitPL7_nLt7PYRXFGUWoPCfWJtwt20aBMPeaOcP10drZcQWlgaUfhe_zS5mst1XqZAFdsQIAJLtEtb56QfcpSI-pz_d681C-tgOOPLnZHPV_gt5UvVNgwgBlTejohjYtf4kGvm5V7yP_RmQTPIHFRf3dpO2Ye8cQ9ihfWtajr38SmuGnInV9UVPipXF9HBLFCtITziaKc7D9PnR3kJkIY94QmzymNCdRRiLt2QzQjDtYhYG2QMZtzSMQOtH7sQouBGQpXsfL-pwZkTfrzGPEfiJIq1PCYSZ9r_lEQWvL1cJx9Zb12m7LzSkFKskiDIACRdu5wmqsAUcHaEcDpOHpq2_KHkfJl6v8x6y2m0rSL24qt94h_WXNaNAig6tnC7WwgWtg4c0IgLbaQzY_u2aKolplWVddlBsSDBYVsRwSG9F3OGdYKkrl2jszU9oyebSzbFn67U4Mr7eT0WOFrEGkPRHiod3ceN-_C0TnJCmmjW8w4hbrB16ZHuiRuYm4-Ba8PsDl1vn5Mh67bdampAn-JPDcqEVmcCPEWHt3nYMpSrPg60UPbVgg1nG3QpvYlksMuM7RTCoLQtB60-Q4vYqwQxasfNa409FfZxPnJz9ib6ZurCvI0nfOJvAa4xAKPPANHQyZ5MUjqqlOgfUsa1YZjAEWwTeLfXZF-YqFFoMqApqpIXQfPrKWtK4cJggDQYfIrMGMC3TaKqduIXc0jU_K1A2W5ZwEspg056BgHoxc3P7j-qk-V1hKluwqcz01Nyc8fd4HM53C0saNrOj083cQdnh-sS954LMQrovmUTcybGwn3R-_di4oRX06-N-4-ThZyt3kr2UjtrbpwGY0gEoNeGesJnLUVfctmJPfyC53DFhn0G6WWwFi45jVwPXiofJFNTSQav9xodPNpfggobroURf9DzP9NZ4I5LnrvR57W2yoqk2emd4o8qjIHopkYYEpBaNPp4dNI65IUv-Sw4dqTRSfNjasI5OYExoXPGpZvzY1BWxP5rwOH2VnAHL-LF6n9L41p93dg7-jiOYprhH8D0ZbK2_8qHMLTD_lOcUgVOW6tDaefcQYkH2Ov24nC1bKP3Rd_S4T4LJgizR1E_9SIHEhny9JmErGnv9a3_1RbV-fpJtxCC7FfVnR-N1ocTvfuIz-E6JImeMr-3TlYUWMNhfd3GiNFGQOj94SWjtbOADtXhgskd2tQdO-2tjOjVCVQXbdZG0tKMzd1ibhchyE83c8pYgIJ69mvBJcDq_YSCk7NJSyu-VFFFPZSycpFmSycA7byzryo2bgZEvyhNxRvZBRRd_NwVjmgB9lqcEqRoOlI9JfHjOK54tyRc0FTBI2teaz3q9Lyp-MX77hHuLD_B3nOsjwUz-ukVNnImnMFrnSTARJeeo4kQvrm8FU8kGACtcjVIQdOVJxdpsqkdbuRYZ-3gVl0Qvy76wAhChTkq5tQLLDVSPAmIh0PzHroNcJXfGD23cPlW02oJSIJnJ_RkBJsp2lrhV-Ki8gbRet8UHfvFguVfpWnrgs3c6Obd_USBief-1KMIlpQoK7PWXryavytZdKR8RUwyaQis-jn7eefMz6PGBsFXTsS-d1x3KeYLtEcmw9OMWSG1A-2uxYe_sD6yHxLGjuG9juUXBKJD9IuFaHIiycLUekLYTbIxt7OUFKYfjtdWHimgvm3IwQ0qSTgW6eA_n-9y8GTXB5L8baTqXKb2nMYXZ88rzItrHh2anuO3Xv7o-pRtb0JEDDSaHgqFJndsmDh2MGbS1AQtrS3Z6dZ_iHn8lMiiFociLAazprM3QASs8J05098LytKOzprCQHGXT2Jz_489w2s_ha7vSuRhIwXqGJWw4R7CkA4e9V8S03l-meDrnzLDxy_WLYwRGqGtYh07Iky9JsC158DV49WSGTlFlQl9mM-BsuxEEmeA_eLjU5vxW_ttB4lq4X1u_HNlVyae3HJQ19a_PMf0gkKgpwskyhd0bbcneD6dWjtl1MxdcTBYclQkSPx_X30sQo7fxeT5haYxN9-bpPxFEJYV-4x2gJzr_MLO1QjR3I8BRlJUeBq19K0S_kIIGxrlTyy9kSFzjGmTfzUuCzzEXaieIAwDoCdoGDZZBnkY3mqK77I3J7nvoTn7YT2ZK7NILxwxL8m1VE8ToVAcO_Q678zv4MuRdfiZ2txGyXp6ezLsIoOGfeOibEu5WgnQ_O0Y8o_aSJTQRNHVa1ylTkJIJyrs80kTS-MzHpyfGSer7woFMt3GDFtOLayfG41JHf6Ty8qagFh8YBvtb5Yltg2pwJRKpfo_svDnfp7EoNv_9BN0YywyfSsSru6A8MN9VrLQrnr1mHnN8W_11hoKWxtRguUbuW7mdeOX2PN2fYlZicJFbng8GxPRLJ-XtvzhUo0DnpErnFpol2BDpjbR7--oQ16O7G_Iz6A74NrSkalKrZqnsDJLvvgRyjAPmwRXtrb6HxCDxRLd-vgCQwWaVV5OrRqfNn0KjpjSp3M5CBS-Qc-Y3MjXKEGneVm0913GwNI62vtmGZv8AwlBhoS7AoYLqyarD_eHOUwPpat0BzdVz2Fz_Fy1jMLuImHxlqVmUPFd4MjidNzOopHE1P-ZKp_0JwVdUYGdi1F2xFTH5OUKz4gHVvxlgJUs4qiRkjvmRPF1DIVJpuy8G2zLB2KmVi6FEVrO8UhVh18DI_Th0nZRal60sE4vX96iB5YWGS2cV25X-A_5VBYaFqu8bYjEtfgfRRYzL2U5MoTl8VGqR5E6wbr88O66RMzn0Ne9ENw2ICOzpGBFoABPYte9AYqkgXZYw88E51IGw-sc2HR2-lYVqYQvxVxtZaGLOR3-d3aZkGpTax39QoJqZ4ViQWjmjome0m2pm_DtL16r08SnIYkwOGiDQJtrvlaV9QdWFzMymbWrfw7Xn3wXMIjqTde8Ydo2aZBEtwk54i2a7S95DS4BN-X-LQALD8Cc4qu5-94aKmiVNK_amMg1W5A1YXH6KIAYVdSF-yHGQwKkYXBVhof_JHfR8eAHZU2403QAQMGa-UVsWrCFA7TiuE1JnxxpLBnd9CEBVsb_-RSuhmWiapQMZ1iWFrfHFzdwB48war-HOHZQOerrm9qMkTpDWTMOz6enYzVewyfyhOPpNfwjFzQ1HTFxsyb-zLY3V7NF0tfosIf-SuQMCbvkfB_hm9JW9wHFQq1jXy557X5-kNeQAHSIKFWGvuCLOskS6DfyDQ5kYGN3_JHVbZe_CmkLfWV5I-4Y0r1U_sK6ib3pbmlRVJcYpxO_e4TS1zYXfYoMfXKtpP0ml7fa2RwNQQ3hRAHPgIjxgigDYaWcgmCRyr7TVZVe5xYH0q2MKZc9lZTq3XCaE4JOr_cuOe693p_5N4HyX4ca1DX_2_qGZoXmvyyNv8S552JCzAJF-jNTiSBjYMCTmf1E3d4liikN-l_lu_72OOiw_05W6icYqaszlpphZKokcmSivShVfycFkumM3b1KiYqKBsmjbtO1dxdGADReAIUHzAwtjyZuGeQ1L8r1NO3igpK78bbl_nROjvuTsXmP494kS3stl83rmALgxOQV7yR33KzMWShy-MYhTis9pevf1rDXoH526CM-K6ndaquY3cSlsOG7BQPHnTfhbrp95aNLulXCpc9D42u3sy1h3bgFEgL7Y0CfK83UabjopbYOPJYupnlyqvNlCrJefabnFBLcjqoC1uBeXcKTYv094e0yu5oQ0Hjx79VT9IlyBBU6iLFP2e9QN6iFvMbbRjpaRlf8FePwD5Gbk&cid=CAQSKQDq26N9bRofZeps79OrLCMxS6XPPvzpt89f3b9CtQfSTZfGJPWpikgXGAEgEw&rfl=2%2Chttps%253A%252F%252Freceitas.ninja%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18275
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 415D 29 KB
11 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18275
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame E9B1 17 KB
6 KB 979ms
979ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 17:26:49 GMT

GET
H3 200 prod_studio_01_247_videomodule.js Show response
s0.2mdn.net/879366/ Frame E9B1 13 KB
5 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/prod_studio_01_247_videomodule.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78b8b9c06e8648b397191402eb4ca35c9a83400e71f2338c84f2ef1393ef32cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5916458164949993969/index.html?e=69&leftOffset=0&topOffset=0&c=iplggZYB3V&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 13:44:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13348
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5003
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Dec 2022 13:44:20 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 82AA 143 B
166 B 13ms
8ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3484
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 16:28:44 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 06E9 1 KB
643 B 14ms
8ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 24162
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 10:44:06 GMT
etag: 48472445140208031
expires: Thu, 01 Dec 2022 10:44:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 75D5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1

43 B
766 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARjZ5uzHATAB&v=APEucNV6O66fKlYszBdQlwg1tR3K45YiaEK5Fb-dbwBFio1l_gOLQvmj06Fzz0keHhhPbVCENOXxYxGea4XVLFYtIDV_uqeHlw606oIFiQbG2V8hRX8u4q3XhjMUc8GzPLLsTqSTa0F6DQYxShWiWqcLuW_5HmjL-vTgxVVb-4GX5qLBg6Xsbjw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 75D5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1

43 B
766 B

10ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARjZ5uzHATAB&v=APEucNV6O66fKlYszBdQlwg1tR3K45YiaEK5Fb-dbwBFio1l_gOLQvmj06Fzz0keHhhPbVCENOXxYxGea4XVLFYtIDV_uqeHlw606oIFiQbG2V8hRX8u4q3XhjMUc8GzPLLsTqSTa0F6DQYxShWiWqcLuW_5HmjL-vTgxVVb-4GX5qLBg6Xsbjw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJzWAKgtg7NJGMbXaKN5bcA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 75D5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMt8pHUymqn2zhLnOzJGV5s&google_cver=1

43 B
1010 B

7ms
7ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMt8pHUymqn2zhLnOzJGV5s&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARjZ5uzHATAB&v=APEucNV6O66fKlYszBdQlwg1tR3K45YiaEK5Fb-dbwBFio1l_gOLQvmj06Fzz0keHhhPbVCENOXxYxGea4XVLFYtIDV_uqeHlw606oIFiQbG2V8hRX8u4q3XhjMUc8GzPLLsTqSTa0F6DQYxShWiWqcLuW_5HmjL-vTgxVVb-4GX5qLBg6Xsbjw

Protocol

HTTP/1.1

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
AN-X-Request-Uuid: 179e2c46-c7cd-4139-9677-6e2d52c15ff3
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMt8pHUymqn2zhLnOzJGV5s&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 75D5
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
AN-X-Request-Uuid: 89ff7678-6826-4833-ab5e-5e1116869706
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 415D 41 KB
15 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191074
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:14 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 290F 1 KB
643 B 8ms
8ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 24162
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 10:44:06 GMT
etag: 48472445140208031
expires: Thu, 01 Dec 2022 10:44:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 415D 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5763082c572ab2ed5ac2cd38ebaab5d3a53654e210b0061d9f5405e6db7565ec

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D71C 41 KB
15 KB 11ms
10ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A7t4COyvYxTviZpaAgsWreNqgQc2aFSqAXd5hyOoxROVP_nDFb8XGsehheMVctUsyNoKIn8N80vrGcNNPWRsv_DngpXMli2BCnq1Ilt3VbTfxz8inmKrlyyfgRLuCSrRRACPqmWnJU1rn7m6QjtvanaFpHR0X8SmTXp5CSm7K48Mkw4H4&cry=1&dbm_d=AKAmf-BRmxhyjxucGwXH4n5nJG2zMBQrEojRt4js46ZgkGV2lvif7EQ99ZhbZ9pnlVFNrIytMVzl4izw5yfBW-rSWa1dlKOzufAlaDU5JmI9v4UfnYAvf2WKYx3g12D0x237rjJ3EDEkHW9bRh8gHnUREzYdB32cE9UgFCWyjfnYaez8jZmdMw8oq8GLfcl_-sOPC2_MEs8l61JGef_T7S0ubDQYThdciUGO51k44XHaIt2xNfkiGh6c6oAI2ZpJcl9W12juvZZswtgiFjUEU9FnB-dfn0hr-4Ch-ran6AvtgMqMvNJ8qUm7SydM5_iXJU8JvsJZPki8sK1gQP2IC2gYklaGJOM1oBGgzZ25asUcwa4r-RCfMjVjqS6ZqS1J-uMawtvG5qnzg7Iv_LluF4r16aVhG4XHtCLyr2Fe7Fu_tpwHQfkC0arW7ku-6knWz1YGV-_QpFks5XUV9lYNB7HnGCLQ9QMf_6QOR4j3xvuBKG1oQNDKb9izQzy7BaHpVnffik1lzUfGMMO_EHmSSMyemHEPe33husaArH5whOLWDtJWsNTRx5-nW0Woo-yGGomvjJL9noFirNolMoT9vE3Izv_5dLZFKvdjERXozXZ8G2kJIi1N-Ng6zG0oQTQAjZ5gyN_b-eyR_fepXtoB7xQh-cgFDP2dsBAtFbf5SZEOrTGf0IsHEWcOGFKw41yTthh5Q2KNqeMLDoMOMuuT2cMLYEbdVFZJNh9Yj9onqjK20jDh7NwvxRCSh1cs5SKMK_UcXGCcz7oHuFwHEwyZG_Ts20tXJEPH6fJGWc-W-kFdjSze0uvOHGL3VrVTPOqlche9uBEHlOdpFKf5RqY6RRD-XVuUd4X28bHZxPbJwRHZyUBB34ai4KRu5vAcg39R0xP08t-ZAvO1OYpfSVDKYEvFc_tsy_SnQnAtbsLkyCCOJxyYDce-6DOiKxPmsU6If8MGdO8ojpciS2vxsft-0-JIfsLVPLCaR-w3SPoyy1Xn26Qdr368F5Cqmuo6Ma5hrOAsyyPMUtxtFz6t2OYEFBdDJgroA88N7gHOS5yFbxEhy2JuWB12rByBJWyU-x2xMEMlmBZluw5lOgCjihJ1JIBFsgfd0-vXGclLAdreBivRDzFJAKTgbHg_zOl1ycbOLrzzTOpYSdZAa2gva9IzHg37erP-CV0Me1OTH8VzwQF1LLsquW31lFYVmZNcTPrkA5grdT7FzPAVWKWOMqdrmG1sHTANWJn7inMw-0x7d6r3r0HeGY1JUP0qv-JEf0mERvB-Usx03Gf8kBxsCDZvUr3HeswnQpT4UvCe1TmHWQCl4XpE3FO6CK4B-FONCQRR7qfprV8DMAft_QHAep3ZG6lL4z-MtMc2dqQWj08YeX9gii015PoILqHA4oSyU3n7j_8r4LuSw0asyXE_Gu8TZt59H08HCQ8iPBIv_wmB96o6Z-evV0gRo-JtgTc1-BtgOPyffnCQJkvkWrXd7duYL5aPsrV-Bm9sy2YEyK_EbkOaEeYC7PjFRVg8GPKtHgajVRY8Xt6r2XHftKVH7nyNNtn_X1PvIPgj1JlbaNN08vU-FOjPZ5-G8EdgwkcCXR49ylo7tIxoAmUs_MVVDaxxiZCCOSCIOyJNGoj6jaKO8lT7XmCuS2QOiOXsrPNBHMBxApRuzs-jf4xNpgqfIwWFUSdMibhbmusPVniXu_YZlzEFKvGd-LhL_K3Y5BUYDx1r_XBpEGqjP7bySbDPPZcEDDnDLrbbYZ1Vti1bXamedRlEIU3cIOtItWZvsJc7Uc9UvsdrfEraLo5Mu3WsL1vhJD-lXGmwCNKA74rOXu_v66uq1Bppo5fnFIF7GrZz493CP5x724hj3raKZVJfUZxOVp3PB3LMCDWGX2_bju2DHRMyUrgDaNCW1vSuGZLt8wqtNC_K8YMKofctI7v9ezVM9CX-e77SiKF_6zplopUkemG2kpbVnZrOmLk9Ym-7YTDk_pohYk4sGnP-44pOKrV_J6nVmoyb7hQxviMHCRcLgcesMZNjrD1n37hDHNBUj7lYeSv3eshYu8zL2abrIpAXApOAJybIceJ4WkcKKEt3gcSiZMsTg9Qo4ODWXJHrlAZxllLWM7BEiFIsP0ofPZ3nExdh45flUpCt-KRR9KJDKL154ZJrwuU9-XDvKePrLDYbEjmKoou8qRQaq1Mh3otxVQZU0VcxdoKPPizJXn914Lg-ZsKdr7RgrCeWqbf_JRxCJa4348BNNVpmGc7fP_PYupbUyHr6Ba5CqOBWeaoIfRPcd0AlFUKzeN1uSrwMxNV3vRWTUtAj5kreMnREanBap8KAwsXGzTzA2ej976snUamTZ3WgssSp2-t-yrMg3cBRjYyxt8v_418xUjW-xenxd4IaTkR9vk4hEdkRZ42irFV3Ko3BzaXgHJRtiN6vmmSzNXQZ1X_Cp4Ocnu14hGynbQuQOQb4lIoLg0R6C7z6kQE_CCHBY06k9XE_R4IsOlIRs046c-F6MFiR6g8cLaDLgINXQcDeaDXebfJ3coRK1_FQBKC5NgBrDjWTqjq9_zcjdrnHVc-XSHzP1kQ-5ue6E_SB9QAQCrgvK3fy3qiz0YrPqZ0iZdjyvkmyRA9GOb9f3JnrtqZcOfKJMOGzmCLvRGgS0idkwIoYsF2-eqyx8ZIlimeNgGrl6Yf9v9Mah_FeCUcuqz2VrrM1F4ILapLg-MV9GSE3G7fJzggNKlMhSvuSe3ZylkovpCA1w3M6gCfENxBkFIW8FxmyMS9ynUkzOoMxsIdgzsE11SfdLM_gTx9zL3tnPMg2KueiyJkOsCxlhRqCSyOrq00Zh9ordnkrlV9H7reD8ONSlpVtrDz_8707HgOGLB_l1_5e6aTxyX5WlIfzQiNVKHdlJpXyPhLITgoHwZmy766a3ZGpYeMgduoyA0liD8gEO9qyyXr0VvD0NNhzZ3rejuDm1NuKVj-QL0nbpeSy-6QYEk_1DYcFyxKHBORBQ8ieouJlNZPxAL2N_Un5B6s6YMNQhQRmFJB94EjuERPnCF7cs5DFn-S_vpffrJSb6O44JpxHD5kBSKYKk4Si97ouvefTAjijUfwAqWuO5I60hY7KS2jN3zQR30VJuI8jyifF7zHC7xgUtzzRRXoPfdXKaiuP&cid=CAQSOwDq26N9H0ALsFVOTEflyoM-eJGOY3GDfG3SimsxRWWMp9p11g2Dm4JfgrHTlws-wVEe2_pjTyUtlnGIGAEgEw&rfl=2%2Chttps%253A%252F%252Freceitas.ninja%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191074
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:14 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame D71C
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1014661/62144026/xbbe/creative/adj?p=APEucNU6xfUmc1GtrKvvboLbchcZ8tsjpxoU4ApKKhbWai91U4Ug7sc&d=CokBAKAmf-C91oKyjQrA6A7zTcRu5GnfVkVlwheRW29eSImhdd6sZ2fqHwgCb2v...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNU6xfUmc1GtrKvvboLbchcZ8tsjpxoU4ApKKhbWai91U4Ug7sc&d=CokBAKAmf-C91oKyjQrA6A7zTcRu5GnfVkVlwheRW29eSImhdd6sZ2fqHwgCb2vXBQO_7U_CgKFGUmnwWta4G91kW...

52 KB
21 KB

118ms
57ms

Script
text/javascript

64.233.167.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNU6xfUmc1GtrKvvboLbchcZ8tsjpxoU4ApKKhbWai91U4Ug7sc&d=CokBAKAmf-C91oKyjQrA6A7zTcRu5GnfVkVlwheRW29eSImhdd6sZ2fqHwgCb2vXBQO_7U_CgKFGUmnwWta4G91kWXgqqTufmKul2Vujzw1ofiU7g8vhLXTiFlcT-TWkctrrX9ZOe3KbgS-ga8AByV05KGUE0RF109wqn1S1KI4mruHbPMB35kInzJISiRUAoCZ_4HmnWN6KulTZRPTcGlM8KRZUuwN-dLrdwi_2gXCZ7sMhmcVhmN7bgqQuQyeEREveeVkie5WcB_QwGgxyYcSvjfT0AKmnoEpClPYLZ8wzq9M7I0ztNKZdGIZS-D3XoMF2YgEdAeVJyDYjIBAa2PKSEvrIglBECn-Q6VLpbTYnaFzyjhYTC5nkmO37_xHcZ59StniLBWSYquiB6zh4nWCuZHe8K3wkXAkzmVezEW3ad7OJMAbNE8kFYl5RrB9R0aLypvjBu_VcSsNjnzaT3TecHLT8UvaH4xP_rCdR1WkZcVDW0Mbkx8gsS-k2K74DSEmhuzoLnZUwFx-JIbMibf8Rz9czWV7gxvXl-BphypNnoRgmYRUuOpsMbiLGy2riTQriO2umGqXTDMeaw0yzul444EsE1L_hWyidB6frs_JDfhEQMf6jO1gum274tsRt2CJxxqFJrwVA25qnWpYERKkBmaSKeqGONEp0mcTw9d2CES8iHJCfsW47N22OftOB5BLKdyWZX3ioYQKJjWZ-Ez4tx-o4cKB1fJcNPIMBJ2Z7kakfUQjU7K0srFa_0P9Myd6DOXHy7PWdJ-ArZLw1fzjcE6YtmvQI5J5n-5bRoM-xWUl0ujCkoDYrft6aFU3etGC9o1DQKU-LLPBtGsRLhqabI2TEAy0R1Y7pwJadNqjHlwBoKUn4ctfKfbEWAiuladQvbRJwQ-QfnKSaxq3skpOYGjxYKz4rvrrn3TRbtdxaXKKf0sdYJXO5sT1BBNF2r2Ri_2xXGU5-6avrjlCJ01BmIUrj_pGq3tGJ9Tq7VS7lIfDUIY8rmDO5W-BW_fmvphzfH53xqF22jypQbafR8htdlDMtE8TkUDE-dCcdZoG7ejcj2ifuI0ZGemfq30iDYmAbOKr-RHfu1fbnnviJ2C5poonpjicKJvH-tfSVzfCQyEycwuor4fp3vkPUQvr6aZIsdtbaCkH9e2x3EE20DPNR1w4m9b5AF8LhVW8mt8wD9CcVUBpXCBtx9t9pbHCMR68xAPotzmLCLkd5LlCjdrzhm4pb-zMreaAcEpTYZaYUXwICkogoA9NYaZ93ebobBZfxBLA4gdIRljaVwwyrJG4TCAxdeAeHLUmG5iS93fzucjCMkXYDF_bYZYgART8ZUnKnvn-tYr4CGew7q6OxD6wbgYieNA6D6Cct1GfLUZCct-PLggdH4Auoeuvbdjl93d1nk8TUyqYe758uiUa0OVh2JuQHNwJURuuQv4DJbKaibQGNsNSkmLEGBysBhv4ZF3Hv_6B5eobrFKx8f7c7nkvwwF27v-gildg0YiYM49uPLZ2OrSMuM_QZuvRjs4OXBiSC4V76Fo97vomp74XKd2ZNBBoHCfd5NjngwdBXB_9eclwVc2BeqBwFbbiFRR3pC-QPNI8UcZZs5Q9j5vPfL9dw3_rR2d-WuTy8QsPlgmmgPPENzVlclM6WE_uhapBApxBwnZn5KT30z0cDtV0OasNlnENJZAZAreYJurjWyZRzQalvrnmUqgHx0I7GWaDLF39kbHg6i1Pln3yW7OtY2_6UsR9qsVAHNQZ6YjHooDbf7pA903BEMwj833E6unee6U1Qi-e-ZnVYq6G1b4nC5eVo3m_LG0TZ30ftfI30QcDCRg79OIULchrcaybhP_2880DdqXaaYB1A_Yag8EKo5ZDwqyY-T3wJNw5j_wFD_zS2pfue14w4EJQzzRqfcjE1rWECRNCDejZX18AERRQohExAMAwb5L7iHxUUuQkaHh9IbHjV7lIVQ9-revkmir3d0x1dp7MsAgrkyaZHZwb7doW63pnkfmtgqwsNc2m1DNVRSr_L8hsxNNqx-yKAychi1UQne3lafWMDwQb2oTjHlrWp4dv7Zwm_qICaMO68MxwlqB8wEfABtL2cUlUdCfiB5MwnhAiRT6_JFgP-JGQyHNXslE36cfrI29wqvmrLKXT06Vs3X_AxsvqjF8qLj1THgx073qrMpJcl1tsXyEhBzkTQCxpuy90MctWJzGYYr9P7__XhXI8eq30js1w7pEoMPxfDda-NOQfw6jQhOkBRzjoG1Lr10qE1syMmUuWXL8cxueNVvl1l_ivtg_vbtI_UQ3qAXk0SpfL6RnJaDdFV5p7rsUou2kiviIVm9Ahfu_mHEvn0ffuzTOh906YjckusWatOxwvEjyjIGBCx9-BVz9Dd_0v3TxbYvPI-03kdb0nLoqB3UWDIkmOOw1CpgwCRoB7wdBfzMM-5Ud-mB3u-17bmMTFiuYi6rI6FNefmgQz-BMRUBOMbGQDDVZXo2IjWZPCs_3cpEEyo_mylzSpymdM9NV8LvYD9Kohp_O9xyijf22k2-8Ji25jAk7R8Wh-wefFgXCfubC037s82KNHlKNkXenBINmKRyeEfwapLJMRzgfVJ5K5sUJmvXR3Ex5Iq8JsQvH_Us9FSqGr4eWZW7AglAPPOb0sZq9XxE3kZGmx1P0KY4lt4dq08YlHHv_ZLdKgk6FZngNUSXfz8SKzX195bMl_6-s5jiCfdbmbYiU5YvtmvUY0_BeQi9T6-YuUf2nCu88jsoNx-Ad8Nrz1Iw4FVs_DtLCPwjW7e8gGBEsaIjAynvkQYSjieUO2Q7-vdS0Z2OOIx1YnyiD2zGKv1kTgkoVTDkekx5A_A-knSo13YjxOV6lFxM3SyP8lq12DEfMkMHOrj555QXk6XyAs-FoaYIacY6SKO4jkzhWCtxUgtmf9mYMy44AKZbgLdeF_Qaw6woRxgJBXc5TJWEF0T3v-hoG3hPwpAcR2FLDh9VMMbW96IOplBBdVm9nMckhhFDFTR_KZS1YCpRYM7u3GlW-kufqInW4gUbVxZO371MLAKxmplJFO8RSV681WEE9LzdmwXRhNKBUjHvDozgVrneirJzTJp23Oqv5Pz-CxUxivmUBdJhf1ZfiIXeGGvgVT2wzVWcUCziQQ3GvJyweLXbpBawm1DPtGdaL1LLl1bIPSMuC5zoaxd1Lwpp5Zfqv5s-EYuA2AzWBEtXPVZOm3WP2fLaV2VbNCWN1mmy7ZijFQvlDr2HrGqBqMMcDzCLcVK-MRUwFuNsfr4XWDNVb4YyXhKWBvoi7Zh_mkOiJ76GDtIfDjDMpKFj9JgE1oeCGtyWTdG18UYtt5cUph8iWvsqRi2kTYVJRGVGoQLHYul1gSmF3wz9fvewaovB-hhN5RUy1H0spj7bNl0GSzAvhq_KTzxcw_TXfcW_jJIDVFOQ4eP-18fbFecsXsZ8mxmbN3fADUt8eYPi9gOAXxGlqBVXAqft7xhl8whx_IKCGX8ye8gqCiHoJDdxhjbbjdcEd3j6vkHR0qpsBPPd4kLmVCsWNsQeDCvHlqQugIMmdLozCfusNP_-2jwhZHwNaJIFigyYrIkO3kggC1BE2XkZgnmNNrjgRxLriUByAtzxMjTkIBIsYfTVyWDpTIo-xoEVcB3AVJ7ObRVlXFGMGtLmDTvw6cni1nTMfdUkEsaQlxINE4XUuatGa2TxQPnPiqsjf5aV57Ov6ahMJ4xJYaT-iyU1Am9uNsBcT0DECAU8m-uxmI-gXNYsiEFuYP5Yat76zOv5i7O9t3Mx6YaQwgEEjsA6tujfR9AC7BVTkxH5cqDPniRjmNxg3xt0oprMUVljKfaddYNg5uCX4Kx05cLPsFRHtv6Y08lLZZxiBgBIBNgAQ

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

64.233.167.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wl-in-f156.1e100.net

Software

cafe /

Resource Hash

5d9540abf6e3ededf35f64aecb5eff8dde813a21e538981b145f5d1c6d879d3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21304
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: app16.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNU6xfUmc1GtrKvvboLbchcZ8tsjpxoU4ApKKhbWai91U4Ug7sc&d=CokBAKAmf-C91oKyjQrA6A7zTcRu5GnfVkVlwheRW29eSImhdd6sZ2fqHwgCb2vXBQO_7U_CgKFGUmnwWta4G91kWXgqqTufmKul2Vujzw1ofiU7g8vhLXTiFlcT-TWkctrrX9ZOe3KbgS-ga8AByV05KGUE0RF109wqn1S1KI4mruHbPMB35kInzJISiRUAoCZ_4HmnWN6KulTZRPTcGlM8KRZUuwN-dLrdwi_2gXCZ7sMhmcVhmN7bgqQuQyeEREveeVkie5WcB_QwGgxyYcSvjfT0AKmnoEpClPYLZ8wzq9M7I0ztNKZdGIZS-D3XoMF2YgEdAeVJyDYjIBAa2PKSEvrIglBECn-Q6VLpbTYnaFzyjhYTC5nkmO37_xHcZ59StniLBWSYquiB6zh4nWCuZHe8K3wkXAkzmVezEW3ad7OJMAbNE8kFYl5RrB9R0aLypvjBu_VcSsNjnzaT3TecHLT8UvaH4xP_rCdR1WkZcVDW0Mbkx8gsS-k2K74DSEmhuzoLnZUwFx-JIbMibf8Rz9czWV7gxvXl-BphypNnoRgmYRUuOpsMbiLGy2riTQriO2umGqXTDMeaw0yzul444EsE1L_hWyidB6frs_JDfhEQMf6jO1gum274tsRt2CJxxqFJrwVA25qnWpYERKkBmaSKeqGONEp0mcTw9d2CES8iHJCfsW47N22OftOB5BLKdyWZX3ioYQKJjWZ-Ez4tx-o4cKB1fJcNPIMBJ2Z7kakfUQjU7K0srFa_0P9Myd6DOXHy7PWdJ-ArZLw1fzjcE6YtmvQI5J5n-5bRoM-xWUl0ujCkoDYrft6aFU3etGC9o1DQKU-LLPBtGsRLhqabI2TEAy0R1Y7pwJadNqjHlwBoKUn4ctfKfbEWAiuladQvbRJwQ-QfnKSaxq3skpOYGjxYKz4rvrrn3TRbtdxaXKKf0sdYJXO5sT1BBNF2r2Ri_2xXGU5-6avrjlCJ01BmIUrj_pGq3tGJ9Tq7VS7lIfDUIY8rmDO5W-BW_fmvphzfH53xqF22jypQbafR8htdlDMtE8TkUDE-dCcdZoG7ejcj2ifuI0ZGemfq30iDYmAbOKr-RHfu1fbnnviJ2C5poonpjicKJvH-tfSVzfCQyEycwuor4fp3vkPUQvr6aZIsdtbaCkH9e2x3EE20DPNR1w4m9b5AF8LhVW8mt8wD9CcVUBpXCBtx9t9pbHCMR68xAPotzmLCLkd5LlCjdrzhm4pb-zMreaAcEpTYZaYUXwICkogoA9NYaZ93ebobBZfxBLA4gdIRljaVwwyrJG4TCAxdeAeHLUmG5iS93fzucjCMkXYDF_bYZYgART8ZUnKnvn-tYr4CGew7q6OxD6wbgYieNA6D6Cct1GfLUZCct-PLggdH4Auoeuvbdjl93d1nk8TUyqYe758uiUa0OVh2JuQHNwJURuuQv4DJbKaibQGNsNSkmLEGBysBhv4ZF3Hv_6B5eobrFKx8f7c7nkvwwF27v-gildg0YiYM49uPLZ2OrSMuM_QZuvRjs4OXBiSC4V76Fo97vomp74XKd2ZNBBoHCfd5NjngwdBXB_9eclwVc2BeqBwFbbiFRR3pC-QPNI8UcZZs5Q9j5vPfL9dw3_rR2d-WuTy8QsPlgmmgPPENzVlclM6WE_uhapBApxBwnZn5KT30z0cDtV0OasNlnENJZAZAreYJurjWyZRzQalvrnmUqgHx0I7GWaDLF39kbHg6i1Pln3yW7OtY2_6UsR9qsVAHNQZ6YjHooDbf7pA903BEMwj833E6unee6U1Qi-e-ZnVYq6G1b4nC5eVo3m_LG0TZ30ftfI30QcDCRg79OIULchrcaybhP_2880DdqXaaYB1A_Yag8EKo5ZDwqyY-T3wJNw5j_wFD_zS2pfue14w4EJQzzRqfcjE1rWECRNCDejZX18AERRQohExAMAwb5L7iHxUUuQkaHh9IbHjV7lIVQ9-revkmir3d0x1dp7MsAgrkyaZHZwb7doW63pnkfmtgqwsNc2m1DNVRSr_L8hsxNNqx-yKAychi1UQne3lafWMDwQb2oTjHlrWp4dv7Zwm_qICaMO68MxwlqB8wEfABtL2cUlUdCfiB5MwnhAiRT6_JFgP-JGQyHNXslE36cfrI29wqvmrLKXT06Vs3X_AxsvqjF8qLj1THgx073qrMpJcl1tsXyEhBzkTQCxpuy90MctWJzGYYr9P7__XhXI8eq30js1w7pEoMPxfDda-NOQfw6jQhOkBRzjoG1Lr10qE1syMmUuWXL8cxueNVvl1l_ivtg_vbtI_UQ3qAXk0SpfL6RnJaDdFV5p7rsUou2kiviIVm9Ahfu_mHEvn0ffuzTOh906YjckusWatOxwvEjyjIGBCx9-BVz9Dd_0v3TxbYvPI-03kdb0nLoqB3UWDIkmOOw1CpgwCRoB7wdBfzMM-5Ud-mB3u-17bmMTFiuYi6rI6FNefmgQz-BMRUBOMbGQDDVZXo2IjWZPCs_3cpEEyo_mylzSpymdM9NV8LvYD9Kohp_O9xyijf22k2-8Ji25jAk7R8Wh-wefFgXCfubC037s82KNHlKNkXenBINmKRyeEfwapLJMRzgfVJ5K5sUJmvXR3Ex5Iq8JsQvH_Us9FSqGr4eWZW7AglAPPOb0sZq9XxE3kZGmx1P0KY4lt4dq08YlHHv_ZLdKgk6FZngNUSXfz8SKzX195bMl_6-s5jiCfdbmbYiU5YvtmvUY0_BeQi9T6-YuUf2nCu88jsoNx-Ad8Nrz1Iw4FVs_DtLCPwjW7e8gGBEsaIjAynvkQYSjieUO2Q7-vdS0Z2OOIx1YnyiD2zGKv1kTgkoVTDkekx5A_A-knSo13YjxOV6lFxM3SyP8lq12DEfMkMHOrj555QXk6XyAs-FoaYIacY6SKO4jkzhWCtxUgtmf9mYMy44AKZbgLdeF_Qaw6woRxgJBXc5TJWEF0T3v-hoG3hPwpAcR2FLDh9VMMbW96IOplBBdVm9nMckhhFDFTR_KZS1YCpRYM7u3GlW-kufqInW4gUbVxZO371MLAKxmplJFO8RSV681WEE9LzdmwXRhNKBUjHvDozgVrneirJzTJp23Oqv5Pz-CxUxivmUBdJhf1ZfiIXeGGvgVT2wzVWcUCziQQ3GvJyweLXbpBawm1DPtGdaL1LLl1bIPSMuC5zoaxd1Lwpp5Zfqv5s-EYuA2AzWBEtXPVZOm3WP2fLaV2VbNCWN1mmy7ZijFQvlDr2HrGqBqMMcDzCLcVK-MRUwFuNsfr4XWDNVb4YyXhKWBvoi7Zh_mkOiJ76GDtIfDjDMpKFj9JgE1oeCGtyWTdG18UYtt5cUph8iWvsqRi2kTYVJRGVGoQLHYul1gSmF3wz9fvewaovB-hhN5RUy1H0spj7bNl0GSzAvhq_KTzxcw_TXfcW_jJIDVFOQ4eP-18fbFecsXsZ8mxmbN3fADUt8eYPi9gOAXxGlqBVXAqft7xhl8whx_IKCGX8ye8gqCiHoJDdxhjbbjdcEd3j6vkHR0qpsBPPd4kLmVCsWNsQeDCvHlqQugIMmdLozCfusNP_-2jwhZHwNaJIFigyYrIkO3kggC1BE2XkZgnmNNrjgRxLriUByAtzxMjTkIBIsYfTVyWDpTIo-xoEVcB3AVJ7ObRVlXFGMGtLmDTvw6cni1nTMfdUkEsaQlxINE4XUuatGa2TxQPnPiqsjf5aV57Ov6ahMJ4xJYaT-iyU1Am9uNsBcT0DECAU8m-uxmI-gXNYsiEFuYP5Yat76zOv5i7O9t3Mx6YaQwgEEjsA6tujfR9AC7BVTkxH5cqDPniRjmNxg3xt0oprMUVljKfaddYNg5uCX4Kx05cLPsFRHtv6Y08lLZZxiBgBIBNgAQ
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 7297 91 KB
23 KB 8ms
8ms Script
application/javascript 2600:9000:223f:9600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:9600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 98652de9f742fc1df9de714d921e14c2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 6054632
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: bB_xlRt2S6WWpEf_GJJnwOF8FSZxLwp1zx18jBRBhxlhWVk_UBZIRw==

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1403499166155550072/ Frame 4B5B 102 KB
25 KB 18ms
17ms Document
text/html 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1403499166155550072/index.html?e=69&leftOffset=0&topOffset=0&c=Uhne8wmJua&t=1&renderingType=2&ev=01_247

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_obb_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3b618dd2d1ac709051d82df0925da065527e6e6a8a3649413d72cebb97c724dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:48 GMT
expires: Thu, 30 Nov 2023 17:26:48 GMT
last-modified: Mon, 07 Mar 2022 13:52:16 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 415D 0
0 53ms
53ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss_KRZTNrPJB5MlEJSFAIAzpFk_VIAgbfG5FUANNn9shYIsbGW4XVSYEf90zd2xVzEk2sxAT1ZZz16pi839EI5QRHude_XDLxASojVk2qbDTMayLTMYBMr8TrreGU_D866twmoOTN2rxTLDoWFk3JuUx5mI1GwpahdE_23fnJXFCPyVEEqh8HgL4SNkTIgzY8Ilg7y5qRyzbhG3-54JwiYr5elO7E8wiJJDYC754xT3aTOkC-MdA_66joYKjBAsXggFMOWsgBCpr7O_pepetvQvr4u3GcDQOLBEiZI6SwJidTtt2zOyGv3xGg9D6hWZ7TVsN-b0-OtAHyDm8jddnc7N49D2zAUI0kXI8zlzPRuv7NyHcznQ-vu7ZD2WEq1DwoLQMrYzVN_FucKCe17767Wah8IDzEW6g74H5dK4R80tTlVisF40J53axe_iBWjcyEySlJVbvolkx97ao6rCcsemmAaPmm6ecscXjjD8TxY0Tc84imZlND0h8zs0Wmz2OHaQpspQg8CdwmcCuLc-nwmEoDzS-ABtDq8FxrZd-TyT53kVr4Obgd370-9_0YSY8eBFnUua5fuh2AnnHeOA_aTlgHZe9Y0Jf1ADMUxpT40BXj4zCKt5hPGGwl2O5tiHjxYSURGrVL1ZfGlJQAzufUQkJPlYaiJbFUWVUwP0-CH0k5n68_6AQFbTKWDTOGAsq_CZW3ObNu-lHk7TEPuPzvCdD-4b8o88J-ivuvzVfC32e0ZgFUnWMnJJvpL_JCXhxylmwFM2yRhnV09VT5RwJUG0MGYRw5aZEgF1LBhspimavgDj9a4W7mhJzM12HVZeWLo73SsiwS6uSMpO8o5X4a5qm5-gWuc5B34ulLctj_u9JtVwk1kUVKsXSP3Aku5oKiO3eeJ6P6TxVhMt6TdXP-0kNHqe8v_GJQEGEednR16-IbkjktXigNkpu09SHm-C1bGOy6UiiUNUSja6PRK3gIMsXZw-M7WAyB7x69GVAwWj1_uN-J02AzLSGRUGQuAUToY058rrTSO_l0j5BE5DoEtW37l4CpGvIVgCT2ru4OlaWi67CHZs36Gk-4lY2S4ynC421YxPqMT0aJygcsEFUTPxLNGAqAE09nA57xC7w23HwGDsDoTZAtycUOREAUqUpUcWZJHIynrWfK1ubti346NZPBQVx7VDpJbqyv-vjbwJbCcA4Og1JJxm1lkCNvXLxfQxdgE7eca3KsTipNVBmBBbQwpO11MuLLJfKziA1-jLxKn5ixzQ0sgZIJ43wQ9yURREl06KGAtNg6NvL7nSRlTM4xbGmjQrFKEUP2nhifAO2hOXva4uky7AgjR1cEIo8X1rg2Jo7isNjRXPRsyVHx8sQZDKtatv-g&sai=AMfl-YTbw-tCqDQ3SIMdGzWKDRAB3660yQv8tGW747r9vffYpfPghaO0Iihwi4648DWzvQuwWwVDctHN0rVEnoLrYMhStvzmLnUTuVAP0W2fXr6lRQvy26ux4G3Rw_raS-lWlKUbP34JKjzqWFtoPyH4DrBM134zJLm3YYKltS-CzuuNZdQnpmi1BVrc7t9_lY9tU6dkxpguldAjLhHDSGc&sig=Cg0ArKJSzN_osH4cMgNYEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=175&cbvp=1&cstd=169&cisv=r20221110.72938&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 30 Nov 2022 17:26:48 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D71C 43 B
215 B 92ms
92ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1014661&asId=9c0b08e3-84bd-94e5-3f01-c4fc6b7112e6&tv=%7Bc:vtmyRM,pingTime:-3,time:83,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:0,h:0,t:23%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:83,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:22,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B77~0%5D,as:%5B77~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbCz+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a11%7C1a12%7C1b1*.1014661-62144026%7C1b11,idMap:1b1*,rmeas:1,rend:0,renddet:IMG.us,siq:24%7D&br=c
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D71C 43 B
215 B 92ms
91ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1014661&asId=9c0b08e3-84bd-94e5-3f01-c4fc6b7112e6&tv=%7Bc:vtmyRN,pingTime:-6,time:84,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:84,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:22,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B78~0%5D,as:%5B78~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbCz+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a11%7C1a12%7C1b1*.1014661-62144026%7C1b11,idMap:1b1*,rmeas:1,rend:0,renddet:IMG.us,siq:24%7D&tpiLookup=ao:receitas.ninja*%2Cb1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com*&br=c
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dpixel
cms.quantserve.com/ Frame 06E9 35 B
210 B 14ms
12ms Image
image/gif 2620:116:800d:21:e365:4988:e8a7:3270
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEND3dcCTsJGAitW6zI4xCcM&google_cver=1&google_push=ASkJ3FZ_zM_fh6cfqpsVkNnsmrGK_mGMrq-5Aj88sLroC6Yp7KOWllE2dRCsm_OXvThwaX0PM7jj7JNnI1w1-LSCBfKxoYGdbt5Q

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:e365:4988:e8a7:3270 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06E9
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESENTmq2GJ1GiLi1wISsRI2u0&google_cver=1&google_push=ASkJ3FY4okS9Mu2yOdxQRCDGhmUDjxng4zWJ37K5HIb5YqT9uIf3jdpzrlPIVU3spEDGDLmIvahfGReYRVCfieOKvAS8cpeCuFo
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3FY4okS9Mu2yOdxQRCDGhmUDjxng4zWJ37K5HIb5YqT9uIf3jdpzrlPIVU3spEDGDLmIvahfGReYRVCfieOKvAS8cpeCuFo&google_hm=Q0FFU0VOVG1xMkdKMUdpTG...

170 B
188 B

24ms
24ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3FY4okS9Mu2yOdxQRCDGhmUDjxng4zWJ37K5HIb5YqT9uIf3jdpzrlPIVU3spEDGDLmIvahfGReYRVCfieOKvAS8cpeCuFo&google_hm=Q0FFU0VOVG1xMkdKMUdpTGkxd0lTc1JJMnUw

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:48 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=ASkJ3FY4okS9Mu2yOdxQRCDGhmUDjxng4zWJ37K5HIb5YqT9uIf3jdpzrlPIVU3spEDGDLmIvahfGReYRVCfieOKvAS8cpeCuFo&google_hm=Q0FFU0VOVG1xMkdKMUdpTGkxd0lTc1JJMnUw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06E9
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DASkJ3FaEsTq_...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DASkJ3FaEsTq_...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjExMzAxNzI2NDkwMDAxMTc1OTQ5MzIwMg%3D%3D&google_push=ASkJ3FaEsTq_caQj1uYFRcrYqCODJ5kozDp_hWzsngHX1uCclLcNKHv5Ll5N4IFVwyntUH...

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjExMzAxNzI2NDkwMDAxMTc1OTQ5MzIwMg%3D%3D&google_push=ASkJ3FaEsTq_caQj1uYFRcrYqCODJ5kozDp_hWzsngHX1uCclLcNKHv5Ll5N4IFVwyntUHR4MG9Ao8s81uJVgK8alcGKVK-RiN0Q

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjExMzAxNzI2NDkwMDAxMTc1OTQ5MzIwMg%3D%3D&google_push=ASkJ3FaEsTq_caQj1uYFRcrYqCODJ5kozDp_hWzsngHX1uCclLcNKHv5Ll5N4IFVwyntUHR4MG9Ao8s81uJVgK8alcGKVK-RiN0Q
pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 0
expires: Wed, 30 Nov 2022 17:26:49 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 06E9 43 B
135 B 43ms
17ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESELR7E5pW3_vg-JAiH5IUgaI&google_cver=1&google_push=ASkJ3Fa-rzeihtKZkRoKMgBiPT13ZJ9TvPl0PsIsvaLEoKLvjeOQBqxHj8BmKbCvwTKVisTwk79CqlqFrcqllT5RWPSFSYMlNy4
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 8i6itbrnm2hqjb4kj3pbfhi8d1kf894a

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06E9
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=dRbDNxmiRR2MIG0h15h2zA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=dRbDNxmiRR2MIG0h15h2zA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FYLPXlonnqXqZ6FZCvyifstgZ0ZWvNzyLahTDQcykIsF8hg7IAA5XIghyGe2PbnryIWA36QK9Eyi8EpoUsBV4LhLfIIkZ17

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=dRbDNxmiRR2MIG0h15h2zA%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FYLPXlonnqXqZ6FZCvyifstgZ0ZWvNzyLahTDQcykIsF8hg7IAA5XIghyGe2PbnryIWA36QK9Eyi8EpoUsBV4LhLfIIkZ17
date: Wed, 30 Nov 2022 17:26:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06E9
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO3YnGUzLYikZiZ-2SYG5P8&google_cver=1&google_push=ASkJ3FaFeeuRTPynub1G8LCRrmJo6NThG2sLjBfns2AT9zmYlghgzKZe8d_o5RqEYpC6PKb1rSW...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczTU8tMjEtN1haVA==&google_push=ASkJ3FaFeeuRTPynub1G8LCRrmJo6NThG2sLjBfns2AT9zmYlghgzKZe8d_o5RqEYpC6PKb1rSWfvgSfXAVw5fBC8zqqDDO4srE

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczTU8tMjEtN1haVA==&google_push=ASkJ3FaFeeuRTPynub1G8LCRrmJo6NThG2sLjBfns2AT9zmYlghgzKZe8d_o5RqEYpC6PKb1rSWfvgSfXAVw5fBC8zqqDDO4srE

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczTU8tMjEtN1haVA==&google_push=ASkJ3FaFeeuRTPynub1G8LCRrmJo6NThG2sLjBfns2AT9zmYlghgzKZe8d_o5RqEYpC6PKb1rSWfvgSfXAVw5fBC8zqqDDO4srE
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 06E9
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEK0gk4o5pIqQzAdVxOjNOAg&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEK0gk4o5pIqQzAdVxOjNOAg&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAADRgAAAIB&google_nid=index&google_push=ASkJ3Fb4zcsbi6FnJ9RDna2p5jV3Skqdad0r1...

170 B
188 B

18ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEK0gk4o5pIqQzAdVxOjNOAg&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAADRgAAAIB&google_nid=index&google_push=ASkJ3Fb4zcsbi6FnJ9RDna2p5jV3Skqdad0r1EpqPKfTk7oNxVrhK9-9aQbMxx_nNp-wOPiktsbqSIV7VgeOu6x3xuvL8vQ49mKc

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hMKKTwaUnne%2F1hEr%2FumcyaiG%2BhzX9RBI6%2BwgiUa6nj5Ihhprb1gjdNAlLqROmvdzr4eVS%2F5OSGzq3zg9kxKQDcgKv6PWBjW6NJ0XmrtsHU8CBOZhxLpRsrnyYb%2FvxbXGjDPCiviEoWvkHw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEK0gk4o5pIqQzAdVxOjNOAg&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAADRgAAAIB&google_nid=index&google_push=ASkJ3Fb4zcsbi6FnJ9RDna2p5jV3Skqdad0r1EpqPKfTk7oNxVrhK9-9aQbMxx_nNp-wOPiktsbqSIV7VgeOu6x3xuvL8vQ49mKc
cache-control: no-cache
cf-ray: 77254a4b48979bb3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 06E9 0
12 B 18ms
18ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JkboDETRrz45vuBVmCbHtgMyEWMC7o8uvt4p5etz1OiOppU1PjpohuBj4dX3Pg9_XOU8mG

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D71C 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1014661&asId=9c0b08e3-84bd-94e5-3f01-c4fc6b7112e6&tv=%7Bc:vtmySm,pingTime:-2,time:119,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:143,beZ:144,mfA:145,cmA:146,inA:147,inZ:151,prA:151,prZ:161,si:166,poA:168,poZ:189,cmZ:189,mfZ:189,loA:227,loZ:230,ltA:262,ltZ:262%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:0,h:0,t:23%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:119,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:22,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B113~0%5D,as:%5B113~0.0%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18.1249092-67007136%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a11%7C1a12%7C1b1*.1014661-62144026%7C1b11,idMap:1b1*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:IMG.us,siq:24,sinceFw:94,readyFired:false%7D&br=c
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 084C 22 KB
8 KB 10ms
9ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 133262
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 04:25:46 GMT
expires: Wed, 29 Nov 2023 04:25:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 4B5B 118 KB
40 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1403499166155550072/index.html?e=69&leftOffset=0&topOffset=0&c=Uhne8wmJua&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1403499166155550072/index.html?e=69&leftOffset=0&topOffset=0&c=Uhne8wmJua&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 10:10:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 26158
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Dec 2022 10:10:50 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 290F
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEND3dcCTsJGAitW6zI4xCcM&google_cver=1&google_push=ASkJ3Fb6BlFPcRdY83HVzuE0Sxkn5IMKKz1nmtY8hLJnieWDCQfEdC2HkC...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3Fb6BlFPcRdY83HVzuE0Sxkn5IMKKz1nmtY8hLJnieWDCQfEdC2HkClzncHU6tfe9xEfizTLkjY2SrWZi1nkht-BJJ_qUSZ5&google_hm=lHonUqOfv_TI...

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3Fb6BlFPcRdY83HVzuE0Sxkn5IMKKz1nmtY8hLJnieWDCQfEdC2HkClzncHU6tfe9xEfizTLkjY2SrWZi1nkht-BJJ_qUSZ5&google_hm=lHonUqOfv_TIhNA_vmcsPw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3Fb6BlFPcRdY83HVzuE0Sxkn5IMKKz1nmtY8hLJnieWDCQfEdC2HkClzncHU6tfe9xEfizTLkjY2SrWZi1nkht-BJJ_qUSZ5&google_hm=lHonUqOfv_TIhNA_vmcsPw
pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 451 466606.gif
id.rlcdn.com/ Frame 290F 0
98 B 39ms
17ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/466606.gif?cparams=google_push%3DASkJ3FaxofHQCGcBLC064ZXO0tbxZj3i7wXMEpiwRxzcvdpZuA4p1o5UfnZguWJnhFcy9TTrwItZkRZcnpGVs3Zf7Yyt_XMnNto8&google_gid=CAESEDHSAH4ZjEzJviXxTK3ivAk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame 290F 43 B
350 B 26ms
17ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESELR7E5pW3_vg-JAiH5IUgaI&google_cver=1&google_push=ASkJ3FYltYwri8dYWaHmmmAi8RCQhal__s5SCJnGvSADGR94D56sGHGWxeDddwBXuut7CiBDMWCZ8bLbI_HyB7C-TiYqXclDgak
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:47 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: hs7otekthcceqmqdeipl7m1pm7l2rmgk

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 290F
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=oLxexvhpT92W5lojBuDNTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

20ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=oLxexvhpT92W5lojBuDNTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FYr4VCFTO5B0V9kPmlhxLCJcGCXvaFgGZhHMPpZB2O2jhkNAjmNXPzmEnilcWintaeDeQusOKGLMQYYlqKrQCq4nxbCWSCu

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=oLxexvhpT92W5lojBuDNTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FYr4VCFTO5B0V9kPmlhxLCJcGCXvaFgGZhHMPpZB2O2jhkNAjmNXPzmEnilcWintaeDeQusOKGLMQYYlqKrQCq4nxbCWSCu
date: Wed, 30 Nov 2022 17:26:48 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 290F
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEO3YnGUzLYikZiZ-2SYG5P8&google_cver=1&google_push=ASkJ3FaSXd_ScRBiQfso-K43uHW5mD3rRY8mdxTqLqQ6YslIwg8jCeSjmOb1kkwGnoroNQz1AlK...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczTU8tMjEtTFpNNA==&google_push=ASkJ3FaSXd_ScRBiQfso-K43uHW5mD3rRY8mdxTqLqQ6YslIwg8jCeSjmOb1kkwGnoroNQz1AlKovofhsKZVcipLbBB5GuNMra4M

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczTU8tMjEtTFpNNA==&google_push=ASkJ3FaSXd_ScRBiQfso-K43uHW5mD3rRY8mdxTqLqQ6YslIwg8jCeSjmOb1kkwGnoroNQz1AlKovofhsKZVcipLbBB5GuNMra4M

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczTU8tMjEtTFpNNA==&google_push=ASkJ3FaSXd_ScRBiQfso-K43uHW5mD3rRY8mdxTqLqQ6YslIwg8jCeSjmOb1kkwGnoroNQz1AlKovofhsKZVcipLbBB5GuNMra4M
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 290F
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEK0gk4o5pIqQzAdVxOjNOAg&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEK0gk4o5pIqQzAdVxOjNOAg&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAADRgAAAIB&google_nid=index&google_push=ASkJ3FatJBaevdA8T03qg5wHoBD1HlbnX_DDL...

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEK0gk4o5pIqQzAdVxOjNOAg&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAADRgAAAIB&google_nid=index&google_push=ASkJ3FatJBaevdA8T03qg5wHoBD1HlbnX_DDL7J4ut6JxxzonuNI9HxmAH45mcT8ukfyuY8S4S-bFKMH4Hk3foVdOdyujkLE7TcW

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MYgvVjRGav4ZwJDCjystiAYvxVmOrLvXPlqDR8LjphhVr3x%2BTS1yVvqzWbKT5Cpct%2FV8ZIeQNfOrwXOuqrcnU0T%2Bg3wveKH%2BHvlsjcOvd12%2BWDy2E7gMTyDZaY6VwLtxSMymKZRWzdsYZA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEK0gk4o5pIqQzAdVxOjNOAg&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAADRgAAAIB&google_nid=index&google_push=ASkJ3FatJBaevdA8T03qg5wHoBD1HlbnX_DDL7J4ut6JxxzonuNI9HxmAH45mcT8ukfyuY8S4S-bFKMH4Hk3foVdOdyujkLE7TcW
cache-control: no-cache
cf-ray: 77254a4b489c9bb3-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 trk
ag.innovid.com/ Frame 290F 43 B
297 B 162ms
19ms Image
image/gif 2a05:d01c:1d8:8100:2de7:20d7:fcf5:3f3d
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESENcP6XfpiQ5PPzp4UFLbMo4&google_cver=1&google_push=ASkJ3FbuotHvTjvK7jRYEga-17UWaSPyyoIHXG_hjMKC_3RHqiF-UdGASVUXAbvL2fVN46krlUZJ02oNqrH2aROCB4xg4eC8Aus
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:2de7:20d7:fcf5:3f3d London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
cache-control: no-cache
content-length: 43
request-time: 1
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 290F 0
12 B 18ms
15ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KVFMgbh3KW1J1zQl7UXtkDtG1HK0nDx9dOsnrxryysztCOLdu8mTzC4_A6yBtOPfK2Ipmp

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:48 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 82AA
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

20ms
20ms

Document
text/html

2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:48 GMT
expires: Wed, 30 Nov 2022 17:26:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:48 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 118F 22 KB
8 KB 8ms
8ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 133262
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 04:25:46 GMT
expires: Wed, 29 Nov 2023 04:25:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DF89 43 B
215 B 93ms
92ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1249092&asId=4a8b93a0-2aac-8809-47b0-35dd7a603f1b&tv=%7Bc:vtmyTt,pingTime:-10,time:620,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA4LjAuNTM1OS43MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1669829208887%7C%7C2949b3442ab690bf933a69a30c6e64d1%7C%7C07ce98dcea487df63115ee06f221a4b9%7C%7Cb04b6d5965951985039e99f6e64a8207%7C%7C326869473cabfc79d276b858a57283a2%7C%7Cd6f1042fb10d45cbc68746cc5f2606ab%7C%7C05605e00d893f3757e687ba56bc9fd29%7C%7C19380be0ff4e7af33ccced52c9210aac%7C%7C1663701684%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2

200

4.js Show response
static.adsafeprotected.com/ Frame 415D
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1211316/66369106/4.js?ias_dspID=3&ias_campId=1009276076&ias_pubId=pub-3685392670532966&ias_chanId=1&ias_placementId=18642321290&bidurl=https://receitas.ninja/s...
https://static.adsafeprotected.com/4.js

1 KB
1 KB

7ms
7ms

Script
application/javascript

2600:9000:223f:9600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/4.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Server: 2600:9000:223f:9600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 27564fe0e5a95c61c9fbd45ecdb0a0a640fbb320bb64a54f3307a52fe96f86e4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

x-amz-version-id: JwdpjwpdyHox6arBzJBAYLJeHm3pnPTp
content-encoding: gzip
via: 1.1 98652de9f742fc1df9de714d921e14c2.cloudfront.net (CloudFront)
date: Mon, 28 Nov 2022 19:50:38 GMT
x-amz-cf-pop: FRA56-P5
age: 164171
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Mon, 21 Nov 2022 19:50:37 GMT
server: AmazonS3
etag: W/"33dffa7df253125904b2f354b5bb5e8d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800
x-amz-cf-id: 5teZ-TY2QXhFJ4ts5uSDlWPlUDtRiUljxkVRkU2Ztv2QNjvGg77Fbw==

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
server: nginx
x-server-name: app14.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/4.js
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 6EF4 91 KB
23 KB 13ms
13ms Script
application/javascript 2600:9000:223f:9600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223f:9600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 98652de9f742fc1df9de714d921e14c2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 6054632
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: dmYx5TCzuCbUZciI7H7NKQMZLllg8CSAN8UH-9XF5Zh1irlPEQiOCw==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 415D 43 B
215 B 93ms
93ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1211316&asId=deb0f33d-741a-669a-804b-c5222de00385&tv=%7Bc:vtmyUH,pingTime:-3,time:71,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:71,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B65~0%5D,as:%5B64~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbFG+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a1*.1211316-66369106%7C1a11%7C1a12%7C1a13%7C1a14%7C1b11%7C1b12%7C1b13,idMap:1a1*,rmeas:1,rend:0,renddet:na,siq:22%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 415D 43 B
215 B 92ms
92ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1211316&asId=deb0f33d-741a-669a-804b-c5222de00385&tv=%7Bc:vtmyUJ,pingTime:-6,time:73,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:73,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B67~0%5D,as:%5B66~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbFG+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a1*.1211316-66369106%7C1a11%7C1a12%7C1a13%7C1a14%7C1b11%7C1b12%7C1b13,idMap:1a1*,rmeas:1,rend:0,renddet:na,siq:22%7D&tpiLookup=ao:receitas.ninja*%2Cgoogleads.g.doubleclick.net*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: nginx
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame DF89 42 B
64 B 52ms
52ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstu9wXVBdVbGkw-268vHeQEJc835QICmpD48r4DKGt4MQoUEpKrhW8Fxq9AMFxD01w7O4rWkrLWhkAsWxPDrYFoe9p9Jhmn6ACpyoMSntrElSzTtNQnzMCiyJFxwcsYsLlHV9rSOQ&sai=AMfl-YSCMyeddnFCORRqNd2MyNJH26Zre-qfVJXdXiOiXyrujZsjR89sllyJO_y7AKXPvRGk7XfZqThuBTLCeg5H0NLgBQ3pOlZcy1ToucBeV7w8OblI5Ys7J0Vdohtg1A&sig=Cg0ArKJSzDWvyVndoqTpEAE&cid=CAQSOwDq26N9d1Yl12pW3ZuKVWnxb_e9YO7hk9HAZUTZSf9-N52DhEODnb_W3AX_lj_kA225_gFzkJRBG7UiGAEgEw&id=lidar2&mcvt=1076&p=315,650,565,950&mtos=1076,1076,1076,1076,1076&tos=1076,0,0,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2311857203&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669829207766&rpt=118&isd=0&lsd=0&met=ce&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 415D 43 B
215 B 92ms
92ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1211316&asId=deb0f33d-741a-669a-804b-c5222de00385&tv=%7Bc:vtmyV2,pingTime:-2,time:92,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:470,beZ:472,mfA:473,cmA:475,inA:475,inZ:479,prA:479,prZ:487,si:492,poA:493,poZ:512,cmZ:513,mfZ:513,loA:543,loZ:546,ltA:562,ltZ:562%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:20%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:92,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B86~0%5D,as:%5B85~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18.1249092-67007136%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a1*.1211316-66369106%7C1a11%7C1a12%7C1a13%7C1a14%7C1b1.1014661-62144026%7C1b11%7C1b12%7C1b13,idMap:1a1*,pd:VEBo.mhjfbmdgcfjbbpaeojofohoefgiehjai,rmeas:1,rend:0,renddet:na,siq:22,sinceFw:70,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20221110/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dc_oe=ChMIqYqRxrbW-wIVruO7CB3YggFzEAAYACDYkZFWQhMI4eraxbbW-wIVdor9Bx0H9Q-c;met=1;&timestamp=1669829208986;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;
ade.googlesyndication.com/ddm/activity/ Frame DF89 42 B
494 B 87ms
46ms Image
image/gif 172.217.18.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIqYqRxrbW-wIVruO7CB3YggFzEAAYACDYkZFWQhMI4eraxbbW-wIVdor9Bx0H9Q-c;met=1;&timestamp=1669829208986;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=0;eid3=11;ecn3=1;etm3=0;eid5=12;ecn5=1;etm5=0;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s28-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 JaguarModernWeb-Bold.woff
s0.2mdn.net/creatives/assets/4449293/ Frame 4B5B 23 KB
23 KB 8ms
8ms Font
font/woff 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4449293/JaguarModernWeb-Bold.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1403499166155550072/index.html?e=69&leftOffset=0&topOffset=0&c=Uhne8wmJua&t=1&renderingType=2&ev=01_247

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

015a41d4cab03a8c23e537a1d78a0f186e5483fadcec3d0f4ab42cbd5aec1622

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/1403499166155550072/index.html?e=69&leftOffset=0&topOffset=0&c=Uhne8wmJua&t=1&renderingType=2&ev=01_247
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:22:43 GMT
x-content-type-options: nosniff
age: 245
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23452
x-xss-protection: 0
last-modified: Mon, 16 May 2022 11:45:42 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 30 Nov 2022 17:37:43 GMT

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame 084C 36 KB
16 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:56:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1826
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 Nov 2023 16:56:22 GMT

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame 118F 36 KB
16 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:56:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1827
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 Nov 2023 16:56:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame D71C 29 KB
11 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1014661/62144026/xbbe/creative/adj?p=APEucNU6xfUmc1GtrKvvboLbchcZ8tsjpxoU4ApKKhbWai91U4Ug7sc&d=CokBAKAmf-C91oKyjQrA6A7zTcRu5GnfVkVlwheRW29eSImhdd6sZ2fqHwgCb2vXBQO_7U_CgKFGUmnwWta4G91kWXgqqTufmKul2Vujzw1ofiU7g8vhLXTiFlcT-TWkctrrX9ZOe3KbgS-ga8AByV05KGUE0RF109wqn1S1KI4mruHbPMB35kInzJISiRUAoCZ_4HmnWN6KulTZRPTcGlM8KRZUuwN-dLrdwi_2gXCZ7sMhmcVhmN7bgqQuQyeEREveeVkie5WcB_QwGgxyYcSvjfT0AKmnoEpClPYLZ8wzq9M7I0ztNKZdGIZS-D3XoMF2YgEdAeVJyDYjIBAa2PKSEvrIglBECn-Q6VLpbTYnaFzyjhYTC5nkmO37_xHcZ59StniLBWSYquiB6zh4nWCuZHe8K3wkXAkzmVezEW3ad7OJMAbNE8kFYl5RrB9R0aLypvjBu_VcSsNjnzaT3TecHLT8UvaH4xP_rCdR1WkZcVDW0Mbkx8gsS-k2K74DSEmhuzoLnZUwFx-JIbMibf8Rz9czWV7gxvXl-BphypNnoRgmYRUuOpsMbiLGy2riTQriO2umGqXTDMeaw0yzul444EsE1L_hWyidB6frs_JDfhEQMf6jO1gum274tsRt2CJxxqFJrwVA25qnWpYERKkBmaSKeqGONEp0mcTw9d2CES8iHJCfsW47N22OftOB5BLKdyWZX3ioYQKJjWZ-Ez4tx-o4cKB1fJcNPIMBJ2Z7kakfUQjU7K0srFa_0P9Myd6DOXHy7PWdJ-ArZLw1fzjcE6YtmvQI5J5n-5bRoM-xWUl0ujCkoDYrft6aFU3etGC9o1DQKU-LLPBtGsRLhqabI2TEAy0R1Y7pwJadNqjHlwBoKUn4ctfKfbEWAiuladQvbRJwQ-QfnKSaxq3skpOYGjxYKz4rvrrn3TRbtdxaXKKf0sdYJXO5sT1BBNF2r2Ri_2xXGU5-6avrjlCJ01BmIUrj_pGq3tGJ9Tq7VS7lIfDUIY8rmDO5W-BW_fmvphzfH53xqF22jypQbafR8htdlDMtE8TkUDE-dCcdZoG7ejcj2ifuI0ZGemfq30iDYmAbOKr-RHfu1fbnnviJ2C5poonpjicKJvH-tfSVzfCQyEycwuor4fp3vkPUQvr6aZIsdtbaCkH9e2x3EE20DPNR1w4m9b5AF8LhVW8mt8wD9CcVUBpXCBtx9t9pbHCMR68xAPotzmLCLkd5LlCjdrzhm4pb-zMreaAcEpTYZaYUXwICkogoA9NYaZ93ebobBZfxBLA4gdIRljaVwwyrJG4TCAxdeAeHLUmG5iS93fzucjCMkXYDF_bYZYgART8ZUnKnvn-tYr4CGew7q6OxD6wbgYieNA6D6Cct1GfLUZCct-PLggdH4Auoeuvbdjl93d1nk8TUyqYe758uiUa0OVh2JuQHNwJURuuQv4DJbKaibQGNsNSkmLEGBysBhv4ZF3Hv_6B5eobrFKx8f7c7nkvwwF27v-gildg0YiYM49uPLZ2OrSMuM_QZuvRjs4OXBiSC4V76Fo97vomp74XKd2ZNBBoHCfd5NjngwdBXB_9eclwVc2BeqBwFbbiFRR3pC-QPNI8UcZZs5Q9j5vPfL9dw3_rR2d-WuTy8QsPlgmmgPPENzVlclM6WE_uhapBApxBwnZn5KT30z0cDtV0OasNlnENJZAZAreYJurjWyZRzQalvrnmUqgHx0I7GWaDLF39kbHg6i1Pln3yW7OtY2_6UsR9qsVAHNQZ6YjHooDbf7pA903BEMwj833E6unee6U1Qi-e-ZnVYq6G1b4nC5eVo3m_LG0TZ30ftfI30QcDCRg79OIULchrcaybhP_2880DdqXaaYB1A_Yag8EKo5ZDwqyY-T3wJNw5j_wFD_zS2pfue14w4EJQzzRqfcjE1rWECRNCDejZX18AERRQohExAMAwb5L7iHxUUuQkaHh9IbHjV7lIVQ9-revkmir3d0x1dp7MsAgrkyaZHZwb7doW63pnkfmtgqwsNc2m1DNVRSr_L8hsxNNqx-yKAychi1UQne3lafWMDwQb2oTjHlrWp4dv7Zwm_qICaMO68MxwlqB8wEfABtL2cUlUdCfiB5MwnhAiRT6_JFgP-JGQyHNXslE36cfrI29wqvmrLKXT06Vs3X_AxsvqjF8qLj1THgx073qrMpJcl1tsXyEhBzkTQCxpuy90MctWJzGYYr9P7__XhXI8eq30js1w7pEoMPxfDda-NOQfw6jQhOkBRzjoG1Lr10qE1syMmUuWXL8cxueNVvl1l_ivtg_vbtI_UQ3qAXk0SpfL6RnJaDdFV5p7rsUou2kiviIVm9Ahfu_mHEvn0ffuzTOh906YjckusWatOxwvEjyjIGBCx9-BVz9Dd_0v3TxbYvPI-03kdb0nLoqB3UWDIkmOOw1CpgwCRoB7wdBfzMM-5Ud-mB3u-17bmMTFiuYi6rI6FNefmgQz-BMRUBOMbGQDDVZXo2IjWZPCs_3cpEEyo_mylzSpymdM9NV8LvYD9Kohp_O9xyijf22k2-8Ji25jAk7R8Wh-wefFgXCfubC037s82KNHlKNkXenBINmKRyeEfwapLJMRzgfVJ5K5sUJmvXR3Ex5Iq8JsQvH_Us9FSqGr4eWZW7AglAPPOb0sZq9XxE3kZGmx1P0KY4lt4dq08YlHHv_ZLdKgk6FZngNUSXfz8SKzX195bMl_6-s5jiCfdbmbYiU5YvtmvUY0_BeQi9T6-YuUf2nCu88jsoNx-Ad8Nrz1Iw4FVs_DtLCPwjW7e8gGBEsaIjAynvkQYSjieUO2Q7-vdS0Z2OOIx1YnyiD2zGKv1kTgkoVTDkekx5A_A-knSo13YjxOV6lFxM3SyP8lq12DEfMkMHOrj555QXk6XyAs-FoaYIacY6SKO4jkzhWCtxUgtmf9mYMy44AKZbgLdeF_Qaw6woRxgJBXc5TJWEF0T3v-hoG3hPwpAcR2FLDh9VMMbW96IOplBBdVm9nMckhhFDFTR_KZS1YCpRYM7u3GlW-kufqInW4gUbVxZO371MLAKxmplJFO8RSV681WEE9LzdmwXRhNKBUjHvDozgVrneirJzTJp23Oqv5Pz-CxUxivmUBdJhf1ZfiIXeGGvgVT2wzVWcUCziQQ3GvJyweLXbpBawm1DPtGdaL1LLl1bIPSMuC5zoaxd1Lwpp5Zfqv5s-EYuA2AzWBEtXPVZOm3WP2fLaV2VbNCWN1mmy7ZijFQvlDr2HrGqBqMMcDzCLcVK-MRUwFuNsfr4XWDNVb4YyXhKWBvoi7Zh_mkOiJ76GDtIfDjDMpKFj9JgE1oeCGtyWTdG18UYtt5cUph8iWvsqRi2kTYVJRGVGoQLHYul1gSmF3wz9fvewaovB-hhN5RUy1H0spj7bNl0GSzAvhq_KTzxcw_TXfcW_jJIDVFOQ4eP-18fbFecsXsZ8mxmbN3fADUt8eYPi9gOAXxGlqBVXAqft7xhl8whx_IKCGX8ye8gqCiHoJDdxhjbbjdcEd3j6vkHR0qpsBPPd4kLmVCsWNsQeDCvHlqQugIMmdLozCfusNP_-2jwhZHwNaJIFigyYrIkO3kggC1BE2XkZgnmNNrjgRxLriUByAtzxMjTkIBIsYfTVyWDpTIo-xoEVcB3AVJ7ObRVlXFGMGtLmDTvw6cni1nTMfdUkEsaQlxINE4XUuatGa2TxQPnPiqsjf5aV57Ov6ahMJ4xJYaT-iyU1Am9uNsBcT0DECAU8m-uxmI-gXNYsiEFuYP5Yat76zOv5i7O9t3Mx6YaQwgEEjsA6tujfR9AC7BVTkxH5cqDPniRjmNxg3xt0oprMUVljKfaddYNg5uCX4Kx05cLPsFRHtv6Y08lLZZxiBgBIBNgAQ&ias_dspID=3&ias_campId=28377781&ias_pubId=pub-4894209870857905&ias_chanId=1&ias_placementId=17455270685&bidurl=https://receitas.ninja/saque-fgts/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0io7Z9MSyA_N3TBw98j7F1b&adsafe_url=https%3A%2F%2Freceitas.ninja&adsafe_type=g&adsafe_url=https%3A%2F%2Freceitas.ninja%2F&adsafe_type=c&adsafe_url=https%3A%2F%2Fb1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2Fb1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=bed&adsafe_jsinfo=,id:9c0b08e3-84bd-94e5-3f01-c4fc6b7112e6,c:vtmyQO,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-55bcfb996c-gf95f,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.0.0,am:i,cc:NaN.NaN.0.0,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:2,mot:0,app:0,maw:0,fm:toGZbCz+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a11%7C1a12%7C1b1*.1014661-62144026%7C1b11,idMap:1b1*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:23,oid:2ba5b18f-70d4-11ed-bb06-9a103fbb8da6,v:19.8.366,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/ Frame D71C 8 KB
3 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1d84738c2afaf595ff5d4921d8dc6bb5ce19a7b9c33a6c02d8a35ff80611cc87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18276
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2986
x-xss-protection: 0
server: cafe
etag: 3296546412363819624
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 200 10817048826355594531
s0.2mdn.net/simgad/ Frame D71C 34 KB
34 KB 11ms
10ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10817048826355594531

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

20d2afef74899487e82d0145eb90f15b88bf036a8cc5567055a5278eff89b9db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 05:03:49 GMT
x-content-type-options: nosniff
age: 217380
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35137
x-xss-protection: 0
last-modified: Mon, 03 Oct 2022 13:27:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 Nov 2023 05:03:49 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 4B5B 7 KB
6 KB 52ms
49ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3a4ad31e4cce831a0e438a97cc99470607bf18f87582c6b761fabd801be41bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5624
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 415D 0
0 48ms
45ms Fetch
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjss_KRZTNrPJB5MlEJSFAIAzpFk_VIAgbfG5FUANNn9shYIsbGW4XVSYEf90zd2xVzEk2sxAT1ZZz16pi839EI5QRHude_XDLxASojVk2qbDTMayLTMYBMr8TrreGU_D866twmoOTN2rxTLDoWFk3JuUx5mI1GwpahdE_23fnJXFCPyVEEqh8HgL4SNkTIgzY8Ilg7y5qRyzbhG3-54JwiYr5elO7E8wiJJDYC754xT3aTOkC-MdA_66joYKjBAsXggFMOWsgBCpr7O_pepetvQvr4u3GcDQOLBEiZI6SwJidTtt2zOyGv3xGg9D6hWZ7TVsN-b0-OtAHyDm8jddnc7N49D2zAUI0kXI8zlzPRuv7NyHcznQ-vu7ZD2WEq1DwoLQMrYzVN_FucKCe17767Wah8IDzEW6g74H5dK4R80tTlVisF40J53axe_iBWjcyEySlJVbvolkx97ao6rCcsemmAaPmm6ecscXjjD8TxY0Tc84imZlND0h8zs0Wmz2OHaQpspQg8CdwmcCuLc-nwmEoDzS-ABtDq8FxrZd-TyT53kVr4Obgd370-9_0YSY8eBFnUua5fuh2AnnHeOA_aTlgHZe9Y0Jf1ADMUxpT40BXj4zCKt5hPGGwl2O5tiHjxYSURGrVL1ZfGlJQAzufUQkJPlYaiJbFUWVUwP0-CH0k5n68_6AQFbTKWDTOGAsq_CZW3ObNu-lHk7TEPuPzvCdD-4b8o88J-ivuvzVfC32e0ZgFUnWMnJJvpL_JCXhxylmwFM2yRhnV09VT5RwJUG0MGYRw5aZEgF1LBhspimavgDj9a4W7mhJzM12HVZeWLo73SsiwS6uSMpO8o5X4a5qm5-gWuc5B34ulLctj_u9JtVwk1kUVKsXSP3Aku5oKiO3eeJ6P6TxVhMt6TdXP-0kNHqe8v_GJQEGEednR16-IbkjktXigNkpu09SHm-C1bGOy6UiiUNUSja6PRK3gIMsXZw-M7WAyB7x69GVAwWj1_uN-J02AzLSGRUGQuAUToY058rrTSO_l0j5BE5DoEtW37l4CpGvIVgCT2ru4OlaWi67CHZs36Gk-4lY2S4ynC421YxPqMT0aJygcsEFUTPxLNGAqAE09nA57xC7w23HwGDsDoTZAtycUOREAUqUpUcWZJHIynrWfK1ubti346NZPBQVx7VDpJbqyv-vjbwJbCcA4Og1JJxm1lkCNvXLxfQxdgE7eca3KsTipNVBmBBbQwpO11MuLLJfKziA1-jLxKn5ixzQ0sgZIJ43wQ9yURREl06KGAtNg6NvL7nSRlTM4xbGmjQrFKEUP2nhifAO2hOXva4uky7AgjR1cEIo8X1rg2Jo7isNjRXPRsyVHx8sQZDKtatv-g&sai=AMfl-YTbw-tCqDQ3SIMdGzWKDRAB3660yQv8tGW747r9vffYpfPghaO0Iihwi4648DWzvQuwWwVDctHN0rVEnoLrYMhStvzmLnUTuVAP0W2fXr6lRQvy26ux4G3Rw_raS-lWlKUbP34JKjzqWFtoPyH4DrBM134zJLm3YYKltS-CzuuNZdQnpmi1BVrc7t9_lY9tU6dkxpguldAjLhHDSGc&sig=Cg0ArKJSzN_osH4cMgNYEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=420&vt=11&dtpt=245&dett=3&cstd=169&cisv=r20221110.72938&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 30 Nov 2022 17:26:49 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E821 1 KB
643 B 7ms
7ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 24163
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 10:44:06 GMT
etag: 48472445140208031
expires: Thu, 01 Dec 2022 10:44:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 4B5B 17 KB
6 KB 477ms
477ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 17:26:49 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 415D 7 KB
6 KB 51ms
50ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=latest&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_obb_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4fc7afd7a69d4cb453962a543f8066832ca58972a032cdb2bd81713e03c1e05e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5649
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E821
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEA4kPyw3zJQwc3hostyjXNU&google_cver=1&google_push=ASkJ3FZh6aHGeB9JrGhfV6XiB6pvBwtNi4M04_KYLq3YD_JzXM63JkCTEVZ1bMhY0HxCLJvkFcNfMM5voL8N-o...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MTg2MTg0MjU2NjA1MTk4Nw%3D%3D&google_push=ASkJ3FZh6aHGeB9JrGhfV6XiB6pvBwtNi4M04_KYLq3YD_JzXM63JkCTEVZ1bMhY0HxCLJvkFcNfMM5voL8N-oOAIR...

170 B
188 B

21ms
20ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MTg2MTg0MjU2NjA1MTk4Nw%3D%3D&google_push=ASkJ3FZh6aHGeB9JrGhfV6XiB6pvBwtNi4M04_KYLq3YD_JzXM63JkCTEVZ1bMhY0HxCLJvkFcNfMM5voL8N-oOAIRKOOqG9LWIVZQ

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzE3MTg2MTg0MjU2NjA1MTk4Nw%3D%3D&google_push=ASkJ3FZh6aHGeB9JrGhfV6XiB6pvBwtNi4M04_KYLq3YD_JzXM63JkCTEVZ1bMhY0HxCLJvkFcNfMM5voL8N-oOAIRKOOqG9LWIVZQ
Date: Wed, 30 Nov 2022 17:26:49 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E821
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEHyS4CHC3uxB5HuFEw164yw&google_cver=1&google_push=ASkJ3FZDWIQ8lhsRjOaK5OKpzljumhw4rR34Pm9VHmPyb7zqh1gwpiLAYFmfqOhpAHfQDIbMaFgzEG-p73frFZ8gaS3c...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEHyS4CHC3uxB5HuFEw164yw&google_cver=1&google_push=ASkJ3FZDWIQ8lhsRjOaK5OKpzljumhw4rR34Pm9VHmPyb7zqh1gwpiLAYFmfqOhpAHfQDIbMaFgzEG-p73frFZ...
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=0718f518-ded9-4dfc-a72b-905b5c1365fa
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=0718f518-ded9-4dfc-a72b-905b5c1365fa
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=7911f905-d8b6-4731-978a-0a73e3390561&user_group=1&ssp=google&bsw_param=0718f518-ded9-4dfc-a72b-905b5c1365fa
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ASkJ3FZDWIQ8lhsRjOaK5OKpzljumhw4rR34Pm9VHmPyb7zqh1gwpiLAYFmfqOhpAHfQDIbMaFgzEG-p73frFZ8gaS3cTmjiJ47J&google_hm=Bxj1GN7ZTfynK5BbXBNl-g==

170 B
188 B

20ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ASkJ3FZDWIQ8lhsRjOaK5OKpzljumhw4rR34Pm9VHmPyb7zqh1gwpiLAYFmfqOhpAHfQDIbMaFgzEG-p73frFZ8gaS3cTmjiJ47J&google_hm=Bxj1GN7ZTfynK5BbXBNl-g==

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ASkJ3FZDWIQ8lhsRjOaK5OKpzljumhw4rR34Pm9VHmPyb7zqh1gwpiLAYFmfqOhpAHfQDIbMaFgzEG-p73frFZ8gaS3cTmjiJ47J&google_hm=Bxj1GN7ZTfynK5BbXBNl-g==
date: Wed, 30 Nov 2022 17:26:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E821
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEGOJV-iQv0mAkKxoeZB9gOg&google_cver=1&google_push=ASkJ3FbcqS7Nfy1BDR7J8bbTMQXrJ2CHm2vT0AxvuA0VL3XgG2WmlxHbF9a9L_lWNGUD_FY4orjgvPgVEwZmQ8bGTr4TUjT...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEGOJV-iQv0mAkKxoeZB9gOg&google_cver=1&google_push=ASkJ3FbcqS7Nfy1BDR7J8bbTMQXrJ2CHm2vT0AxvuA0VL3XgG2WmlxHbF9a9L_lWNGUD_FY4orjgvPgVEwZmQ8bGTr4TU...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ASkJ3FbcqS7Nfy1BDR7J8bbTMQXrJ2CHm2vT0AxvuA0VL3XgG2WmlxHbF9a9L_lWNGUD_FY4orjgvPgVEwZmQ8bGTr4TUjTadUZs

170 B
188 B

21ms
21ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ASkJ3FbcqS7Nfy1BDR7J8bbTMQXrJ2CHm2vT0AxvuA0VL3XgG2WmlxHbF9a9L_lWNGUD_FY4orjgvPgVEwZmQ8bGTr4TUjTadUZs

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ASkJ3FbcqS7Nfy1BDR7J8bbTMQXrJ2CHm2vT0AxvuA0VL3XgG2WmlxHbF9a9L_lWNGUD_FY4orjgvPgVEwZmQ8bGTr4TUjTadUZs
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E821
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEMzt5ZURMLqrIL1tvbY5bZE&google_cver=1&google_push=ASkJ3FYiq3z1VAbvIQzRhklDLCrNomQJuOqGUGTx4fwwY4Li6QoHlGdMZarMGGFUjz1BVIkWnn8...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczVTUtUS1ERkY2&google_push=ASkJ3FYiq3z1VAbvIQzRhklDLCrNomQJuOqGUGTx4fwwY4Li6QoHlGdMZarMGGFUjz1BVIkWnn8Y7FcCIrcTL3N-AW2FpDemgQOKQw

170 B
188 B

22ms
20ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczVTUtUS1ERkY2&google_push=ASkJ3FYiq3z1VAbvIQzRhklDLCrNomQJuOqGUGTx4fwwY4Li6QoHlGdMZarMGGFUjz1BVIkWnn8Y7FcCIrcTL3N-AW2FpDemgQOKQw

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEIzWDczVTUtUS1ERkY2&google_push=ASkJ3FYiq3z1VAbvIQzRhklDLCrNomQJuOqGUGTx4fwwY4Li6QoHlGdMZarMGGFUjz1BVIkWnn8Y7FcCIrcTL3N-AW2FpDemgQOKQw
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E821
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEAM0Q4hcqPrzgXr-5ZNvxGE&google_cver=1&google_push=ASkJ3FYaW0zcxuFuLylm3g_5Ghcl-aTKaHOktCBQgaXkMQIffdKWG-cf39rzUJlQCQKNe-CHZUIHTnYa-L5_...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FYaW0zcxuFuLylm3g_5Ghcl-aTKaHOktCBQgaXkMQIffdKWG-cf39rzUJlQCQKNe-CHZUIHTnYa-L5_UanINhD2eTAHqimhKw

170 B
188 B

19ms
18ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FYaW0zcxuFuLylm3g_5Ghcl-aTKaHOktCBQgaXkMQIffdKWG-cf39rzUJlQCQKNe-CHZUIHTnYa-L5_UanINhD2eTAHqimhKw

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FYaW0zcxuFuLylm3g_5Ghcl-aTKaHOktCBQgaXkMQIffdKWG-cf39rzUJlQCQKNe-CHZUIHTnYa-L5_UanINhD2eTAHqimhKw
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E821
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEI...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=ASkJ3Fb7kRYxNzwUo4297Pd31fm-ckRpJqWbVXVFDXR-6tDepMy7cE-nXU7ohRYNZD3oSpVub42LitwVVksGO4UlBYQUuZlzIqg3hg&redir=https%3A%2F%2Fcm.g.dou...
https://sync.targeting.unrulymedia.com/csync/RX-1f1ee9f1-3363-473f-9346-cf0f85997655-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DASkJ3Fb7kRYxNzwUo4297Pd31...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ASkJ3Fb7kRYxNzwUo4297Pd31fm-ckRpJqWbVXVFDXR-6tDepMy7cE-nXU7ohRYNZD3oSpVub42LitwVVksGO4UlBYQUuZlzIqg3hg&google_hm=Ax8e6fEzY0c_k0bPD4WZdlU

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ASkJ3Fb7kRYxNzwUo4297Pd31fm-ckRpJqWbVXVFDXR-6tDepMy7cE-nXU7ohRYNZD3oSpVub42LitwVVksGO4UlBYQUuZlzIqg3hg&google_hm=Ax8e6fEzY0c_k0bPD4WZdlU

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ASkJ3Fb7kRYxNzwUo4297Pd31fm-ckRpJqWbVXVFDXR-6tDepMy7cE-nXU7ohRYNZD3oSpVub42LitwVVksGO4UlBYQUuZlzIqg3hg&google_hm=Ax8e6fEzY0c_k0bPD4WZdlU
date: Wed, 30 Nov 2022 17:26:49 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RX1f1ee9f13363473f9346cf0f85997655003
content-type: text/html

GET
H2

200

/
onetag-sys.com/match/ Frame E821
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEAM0Q4hcqPrzgXr-5ZNvxGE&google_cver=1&google_push=ASkJ3FbZoqSm3aN8qIJg2GVZJNCGYhDkBCX1oxmOL8powe568-izE4iSTQ6MAA4k8687ngUVH9ivBJEXY39...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FbZoqSm3aN8qIJg2GVZJNCGYhDkBCX1oxmOL8powe568-izE4iSTQ6MAA4k8687ngUVH9ivBJEXY39-n_GcK5HH3Zf2PZxs-w
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

11ms
10ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E821 0
12 B 16ms
16ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JXPW-KqbXXgWHg67CHADbPLPJZkxesZOqYCRXOUoWjMqpdk3m4QDaOtqgoyQYp9NDdQZi1GA

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 logo_w.png
s0.2mdn.net/sadbundle/1403499166155550072/ Frame 4B5B 4 KB
4 KB 10ms
9ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1403499166155550072/logo_w.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

68afaa30f6d8d60f0a9f6388bebaa999721bfdd952cd72f51001e38429998e88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1403499166155550072/index.html?e=69&leftOffset=0&topOffset=0&c=Uhne8wmJua&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Fri, 25 Nov 2022 11:46:07 GMT
x-content-type-options: nosniff
age: 452442
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4082
x-xss-protection: 0
last-modified: Mon, 07 Mar 2022 13:52:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 25 Nov 2023 11:46:07 GMT

GET
H3 200 logo_b.png
s0.2mdn.net/sadbundle/1403499166155550072/ Frame 4B5B 4 KB
4 KB 12ms
11ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1403499166155550072/logo_b.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f169eeda129a6da4b6b300b770a3c32ac3ccc558513a751e26c7c3c8e5a914e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1403499166155550072/index.html?e=69&leftOffset=0&topOffset=0&c=Uhne8wmJua&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Thu, 24 Nov 2022 12:50:20 GMT
x-content-type-options: nosniff
age: 534989
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4103
x-xss-protection: 0
last-modified: Mon, 07 Mar 2022 13:52:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 24 Nov 2023 12:50:20 GMT

GET
H3 200 60026183_20220305150152230_X761_21MY_034_GLHD_728x90.jpg
s0.2mdn.net/ads/richmedia/studio/60026183/ Frame 4B5B 20 KB
20 KB 12ms
11ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60026183/60026183_20220305150152230_X761_21MY_034_GLHD_728x90.jpg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

238542c122a682e0ceea987597dc1d19055ad704b7dc67d09950f15dd7b3e05b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1403499166155550072/index.html?e=69&leftOffset=0&topOffset=0&c=Uhne8wmJua&t=1&renderingType=2&ev=01_247
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:18:12 GMT
x-content-type-options: nosniff
age: 18517
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20903
x-xss-protection: 0
last-modified: Sat, 05 Mar 2022 23:01:52 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 01 Dec 2022 12:18:12 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 415D 17 KB
6 KB 395ms
395ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_obb_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 17:26:49 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 415D 43 B
215 B 93ms
92ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1211316&asId=deb0f33d-741a-669a-804b-c5222de00385&tv=%7Bc:vtmyYi,time:294,type:e,im:%7Bpci:%7Btdr:113%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:294,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B288~0%5D,as:%5B287~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:140,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18.1249092-67007136%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a1*.1211316-66369106%7C1a11%7C1a12%7C1a13%7C1a14%7C1b1.1014661-62144026%7C1b11%7C1b12%7C1b13,idMap:1a1*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:22,sis:131%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: nginx
x-server-name: dt25.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 084C 0
20 B 46ms
46ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZDsEWJKHY9LJHdflx_APwNiskA4AAAAAOAHgBAI&bg=!8vGl8bXNAAbvMpMzzzI7ACkAdvg8WvKRH6R-Gz88rNnO4XUa6sOrVsrhg2HdVnO1SDo15FrD2SNfDAIAAACqUgAAAANoAQeZAvZNvPmlud90JJcscHfV-_LUvDlIp4F_Re79-Fyr461taebuMorgY1JLlFWi1kQr5q-lrWKrHMaohJZ0h6YOCVYDtCamplc2KWXl0_DaKe49pzzmszbyupg4Q0d33XSDbdeD1-5_RwscyNu3lqh5hmiTX0tEBofExdF6cgJyeLr9LU7i1aCHsXP25jASMGVMyhLUtiHmXtk1AeZeSH_6s4xXfx7td1Buw321Lsc_LwsEiWcZPA6Jf1pvye2X2APUl1AzBadSwf4ceua5PmKq9r7rjmq8tpvLMGJR-NEnKhLwryhPyzUm71K43d99u0lGnpX9i82cdKV1go4relzsWb6XcuyJhg5JX7DBpXF6KWgLY3RlstjXZGhCIqxs1XenH9sAJzBaFG0lTu6wW0ufpeax7DSxL4lEO8r-7PtwGj_NgPqpkmMb8qz2itJvT-twRYP2AfkDYlvE-x25NhKEu-uRVZ4-rLyBoK4F9J9Yz_i2fXgA_4sVTQ03uvevIpUjwR_9UsTKEy1RwBB1q8CjUMu-vA0B1-gG5SzD6QBuEoGsHXnAxivYucUzIs7TnRH3wVLgYxhZfu8btlZX4bwllyGnOho6IUN4cCDfMW8YNXSIruM1tS9C6ApEh72sxuVroWBgGg5jLAaujiHsqu1f53HLLmIUlcwRgTzmo7o3yPBq_-H7IAC5nTzYvVqIRJOllSYbJTRa44iPdB4hrQJrdK7JxlgfxfCGVGNUSStAotpSZyOPfILIuc-arfzwwzt1jk-gIESKasG56SxbfYV_FNZVK27zuqnWDddjWalpYP7B5ONMgWjjZ5wWy9G3WJ3iynMyVhUUTJIyqbOYvblUp_SCq--jQKk9A6UlAbYpMLsoVVDwtc9L10jVzggkZW0r_A4QM6ZJS6G_0li5fAipRVsQ0r1mCn4WxGPPncWO4iG0acyv4eWp_SvY5oAxqlvHbqEKoxKSa3f8zvIJsiAveM4MJa15d513Ph9jw2SQ0lkTQE050tBAIw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 118F 0
20 B 46ms
46ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B-4M3WJKHY4THJJ2D9u8P0-6R2AwAAAAAOAHgBAI&bg=!mZqlmt7NAAbvMpMzzzI7ACkAdvg8WgH2vsKWRj8tLF0VmDkYnzVeVbgREis7UmIyQj33_AvjLQ0RyQIAAAChUgAAAAJoAQeZAzvnxojPfLZm-zluAZ-WHcZCDI63B-Jhzc3SvMMVyDWaC0Ga_He2a6Prd8BEhQeFk2MxJ4IHeg288Rcc1GB83NGMAbi5h1imRMljyez0l8qIfM3MzilG8BZRHpatXzhQPzNHaDhg-Oyr1O4CwuzdKDzTfFd1vx5QbUId3HD9qYb5OYTw8hfurb8RYlEkeiesj6Hwx5FBP9CeJ8ZCQRwPERSuVlZqO0g1WdqV4up9rNPJG_yXElBjieGSyiJ4PQ4K2mWDYum92Q2o0VWw--8zOUz4WZK0GK3BADqEVlE3-cNRJW_QTjUPd9Xtw3l6i5uAQRb92PXS_fqUSqnHbru0E2Wt_Eh8cQp3udP-RfsNzyngrypvrWxEONxvMMopSqkGHAWn1zp0QAOtQFoinuO6_fET9FY__kS2bnnIXIDYhknabL_kuQQIJ61snfTU8CZqOXobIIsoaKxuKSuJf7HiIYJDmU6iO64o0szwpV5cy35pp3cQeLdhuqeBLgdP2zATAJKt6ZbIupHd-hI9nttq2Wi1z9DIalbcHwVaC-X1VTbnmhztQ99aoge65EAhI28QV41LK8YyLCFXPcCDMdqjQwCYewFWHwed4Ci8HJTi5G51NKRByYXqnW_VFjhcshGOAvFWtP7hX8asqcD4-gEDoq3xFnEIphYZRIXESTD_aWDHe3vgPdsiKjD57i2zJFtbj729dA_Ni3Ew1Wt1qX7maBXp3hKQSAQj02ocn3xqf0vmP_j7hVj8mkt405UyWwBzJJqrhd_MzRwJkAUSSs5RagL8GqaXnVbpozM7qWGlwu_Npmf_VfSholVd6bLt4iDfVKVciNcYPLSzATnT1LvmMf486fIlMSafmVQISv6ZiUwCmYuxy6eORRBsOJemVlrSG2-wrHdbIN32x-rESNt0Y46qRhamEc-jljQEDFs0VkxahXuLdS850el38E8sbA5OUeaPGUyME_5_lp4eLAOmRS4Z8tnrqj3emSx-GXpX8c9aSwrrS7oryZYDcBuA0N7Rxdk8uaZqjSPcjFlknj6Cn9r9x33btBZMGjcRsqk30YcQh1148isTD1byMVdRKVmKWEsYe7m9N9ZD9NdBNA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame D71C 43 B
215 B 384ms
384ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1014661&asId=9c0b08e3-84bd-94e5-3f01-c4fc6b7112e6&tv=%7Bc:vtmyZY,pingTime:-10,time:591,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTA4LjAuNTM1OS43MSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222222222222222202222222220222202000022000220222222220000022202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1669829208887%7C%7C2949b3442ab690bf933a69a30c6e64d1%7C%7C07ce98dcea487df63115ee06f221a4b9%7C%7Cb04b6d5965951985039e99f6e64a8207%7C%7C326869473cabfc79d276b858a57283a2%7C%7Cd6f1042fb10d45cbc68746cc5f2606ab%7C%7C05605e00d893f3757e687ba56bc9fd29%7C%7C19380be0ff4e7af33ccced52c9210aac%7C%7C1663701684,sca:%7Bspg:4a8b93a0-2aac-8809-47b0-35dd7a603f1b%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DF89 43 B
215 B 165ms
164ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1249092&asId=4a8b93a0-2aac-8809-47b0-35dd7a603f1b&tv=%7Bc:vtmz3w,pingTime:1,time:1243,type:p,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:129%7D,%7Bpiv:0,vs:o,r:l,t:206%7D,%7Bpiv:100,vs:i,r:,t:241%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1002,o:241,n:206,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:129,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B89~1,0~0%5D,as:%5B89~300.250%5D%7D%7D,%7Bsl:o,t:206,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B34~0%5D,as:%5B34~300.250%5D%7D%7D,%7Bsl:i,t:241,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:125,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18*.1249092-67007136%7C181%7C182%7C183%7C184%7C19%7C1a%7C1b1.1014661-62144026%7C1a1.1211316-66369106,idMap:18*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:130,sis:318%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: nginx
x-server-name: dt31.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame DF89 43 B
215 B 165ms
165ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1249092&asId=4a8b93a0-2aac-8809-47b0-35dd7a603f1b&tv=%7Bc:vtmz3w,pingTime:1,time:1243,type:pf,clog:%5B%7Bpiv:-1,vs:n,r:,w:300,h:250,t:129%7D,%7Bpiv:0,vs:o,r:l,t:206%7D,%7Bpiv:100,vs:i,r:,t:241%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1002,o:241,n:206,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:129,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:-1,obst:0,th:0,reas:,bkn:%7Bpiv:%5B89~1,0~0%5D,as:%5B89~300.250%5D%7D%7D,%7Bsl:o,t:206,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B34~0%5D,as:%5B34~300.250%5D%7D%7D,%7Bsl:i,t:241,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:sp,cc:0.0.300.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1002~100%5D,as:%5B1002~300.250%5D%7D%7D%5D,slEventCount:3,em:true,fr:false,e:,tt:rjss,dtt:125,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18*.1249092-67007136%7C181%7C182%7C183%7C184%7C19%7C1a%7C1b1.1014661-62144026%7C1a1.1211316-66369106,idMap:18*,rmeas:1,rend:1,renddet:XIFRAME.qs.dr,siq:130,sis:318%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
server: nginx
x-server-name: dt32.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame 81C9 36 KB
16 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:56:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1827
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 Nov 2023 16:56:22 GMT

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame FEC0 36 KB
16 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:56:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1827
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 Nov 2023 16:56:22 GMT

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame 610D 36 KB
16 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:56:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1827
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 Nov 2023 16:56:22 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 415D 42 B
64 B 52ms
52ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssBqXtIDfXL5ZcJ2qxCr2XlWTjr13qNsOWVbOsijk_4YOLdnXVAlfk7OkxRaGAwMLT6BflLBjwbRNJC4wNkKfxmolBZKtEvEoWsvqTUeggqCxuN2X2gwIiwDebEG2uNa_02-md52w&sai=AMfl-YQ5mTnRz3Kh93rCNYpJapmM6SsyMFmipXTsi_zSe13Sdy-1L4dvdygr2Txrb1ZFyriRxqanbQAVNzb6BuhhFX3LwXyimhflYGljhg&sig=Cg0ArKJSzAikQU0Nc3V8EAE&cid=CAQSKQDq26N9bRofZeps79OrLCMxS6XPPvzpt89f3b9CtQfSTZfGJPWpikgXGAEgEw&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=455,861,1000,1000,1000&tos=455,406,139,0,0&v=20221110&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1669829208422&rpt=367&met=ie&wmsd=0&pbe=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 252F 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:810::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022112901.js?cb=31071038

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://receitas.ninja/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:46 GMT
expires: Thu, 30 Nov 2023 17:26:46 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 959A 624 B
242 B 47ms
45ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjZ1K_aATAB&v=APEucNUSpxXdl176g1BmpaF0LX_s3P7Ytf_HudYfIf7UT6_BfK2QxpHfhGhSkKHKlkymO12T4yJO_FmyQ49XDSMAEHw4sO5iGRy4QrN2ksyL55aP_ad5KaBCva8AScsf4APu2hFmW0GJZiSvCP9fwDTnt-7kibzi9sjHw8lXh9DHkuAPz-SSWqk

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 17:26:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 252F 76 KB
27 KB 77ms
76ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

def1424f4f259a4cf927fe1f7ea7ec24bdc2fc78edca55fdb593cc0c293dbec5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:50 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27387
x-xss-protection: 0
server: cafe
etag: 15442950961169408521
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 30 Nov 2022 17:26:50 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 252F 42 B
63 B 43ms
41ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cj7_xFODYjFuOJSSe12G6saxSQOJtA-phBUN3-K7ty2PRQTjTiC0Z7l-JNz2-6QFXgA8g2YvqUU6QFqsO34tlC2ToO4VadvYKVZAD1GHjhS2lrtC4

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 252F 0
20 B 44ms
42ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=10505979272229304917&x=1&ct=77

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adition.js Show response
imagesrv.adition.com/js/ Frame 252F 32 KB
8 KB 45ms
12ms Script
application/javascript 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/adition.js
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 70e0a3b2c82384039a2e4b31c305c9ef1f72a59b585acad421c54a6101a25237

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:50 GMT
content-encoding: br
last-modified: Thu, 21 Oct 2021 06:32:42 GMT
etag: "4043560335-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 8355

GET
H2 200 js Show response
ad1.adfarm1.adition.com/ Frame 252F 3 KB
2 KB 56ms
16ms Script
application/x-javascript 217.79.188.2
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad1.adfarm1.adition.com/js?wp_id=4745913&gdpr=&gdpr_consent=&kid=5585645&clickurl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK-j7_UP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi-VjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9_yTLu61QQ2H-ZjL1G5OkL6ntaixgvh9tu1O8vheV-RVaUa9R4_GTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC-tjWhjuAmLizLa71HzN-oy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L-UKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe-f8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu-rHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08-3fAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf_KdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64_3uCW10ThkFO3xbh_LybvxPrwNjvw%26client%3Dca-pub-4894209870857905%26dbm_c%3DAKAmf-Aj-otENwqpMt-v6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb-bOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm_d%3DAKAmf-CBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6-IPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO-jCsNKZ0CmohSsb2bOe6NtxxCOQqQ-hzl0V_nkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF_EKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI_8sG2OXPdf_PfBi9fhtur4iu_ZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv-_3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs_dMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi_sieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R-UbUGiaCHxBtSdDY2ZuA75tqXmDelU-bJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb_pxvgvqaWjUNQvIpJXRpnFi3UeL-NDyccjVHE80xkMVidRlyUL_InldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi_mSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3D
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.2 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad1.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: ff27ad722161edbffa14f855dcc9479fb91f4ca4ccf68059e0cd4f6354a56187

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
date: Wed, 30 Nov 2022 18:26:50 +0100
cache-control: max-age=600
content-encoding: gzip
content-type: application/x-javascript
server: ADITIONSERVER v1.0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 252F 3 KB
1 KB 10ms
8ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/window_focus_fy2021.js

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:58:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1704
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 16:58:26 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/ Frame 252F 18 KB
7 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20221110/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f24ab4db72c7344d41ebc97ace3f7bb0ad6198999d180b4ba473b6651cbe53

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18277
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7458
x-xss-protection: 0
server: cafe
etag: 16870613375306414947
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 252F 0
0 17ms
16ms Image
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR-UiWtCzOdvp0bIyKlNEg7GoVsHrMsd7mumF2t0SulAkkTX3aRHYMo1pAk8k08ATHynInitN0c-UbgNIVtdu_NoSxSTw
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 252F 154 KB
47 KB 84ms
83ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8563a9d08eecbb41965521ca0bc40e33a394e4c55789ae383e2a8168fdc5590d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 48265
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1668095300071091"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 30 Nov 2022 17:26:50 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 415D 43 B
215 B 92ms
92ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1211316&asId=deb0f33d-741a-669a-804b-c5222de00385&tv=%7Bc:vtmzgZ,pingTime:1,time:1453,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:20%7D,%7Bpiv:100,vs:i,r:,t:452%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:452,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B446~0%5D,as:%5B445~728.90%5D%7D%7D,%7Bsl:i,t:452,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:94,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18.1249092-67007136%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a1*.1211316-66369106%7C1a11%7C1a12%7C1a13%7C1a14%7C1b1.1014661-62144026%7C1b11%7C1b12%7C1b13,idMap:1a1*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:22,sis:131%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 415D 43 B
215 B 93ms
92ms Image
image/gif 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1211316&asId=deb0f33d-741a-669a-804b-c5222de00385&tv=%7Bc:vtmzgZ,pingTime:1,time:1453,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:20%7D,%7Bpiv:100,vs:i,r:,t:452%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1001,o:452,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:20,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B446~0%5D,as:%5B445~728.90%5D%7D%7D,%7Bsl:i,t:452,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1001~100%5D,as:%5B1001~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:94,fm:toGZbvB+11%7C12%7C13%7C14%7C1511%7C1512%7C16%7C17%7C18.1249092-67007136%7C181%7C182%7C183%7C184%7C185%7C1911%7C1912%7C1a1*.1211316-66369106%7C1a11%7C1a12%7C1a13%7C1a14%7C1b1.1014661-62144026%7C1b11%7C1b12%7C1b13,idMap:1a1*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:22,sis:131%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:daab:4eb7:3635:fbbc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 959A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4aOT6M8R2wJWeYz2QiBpA&google_cver=1

43 B
766 B

25ms
13ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4aOT6M8R2wJWeYz2QiBpA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjZ1K_aATAB&v=APEucNUSpxXdl176g1BmpaF0LX_s3P7Ytf_HudYfIf7UT6_BfK2QxpHfhGhSkKHKlkymO12T4yJO_FmyQ49XDSMAEHw4sO5iGRy4QrN2ksyL55aP_ad5KaBCva8AScsf4APu2hFmW0GJZiSvCP9fwDTnt-7kibzi9sjHw8lXh9DHkuAPz-SSWqk
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:50 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4aOT6M8R2wJWeYz2QiBpA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 959A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=Y4eSVwfDT9Q2ZfFQ7I13ZAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4aOT6M8R2wJWeYz2QiBpA&google_cver=1

43 B
766 B

10ms
10ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4aOT6M8R2wJWeYz2QiBpA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjZ1K_aATAB&v=APEucNUSpxXdl176g1BmpaF0LX_s3P7Ytf_HudYfIf7UT6_BfK2QxpHfhGhSkKHKlkymO12T4yJO_FmyQ49XDSMAEHw4sO5iGRy4QrN2ksyL55aP_ad5KaBCva8AScsf4APu2hFmW0GJZiSvCP9fwDTnt-7kibzi9sjHw8lXh9DHkuAPz-SSWqk
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:50 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEC4aOT6M8R2wJWeYz2QiBpA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 959A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIU2ujVEsW9wwFRQsyd1oyc&google_cver=1

43 B
1010 B

10ms
10ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIU2ujVEsW9wwFRQsyd1oyc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPjqRhC5lOngAhjZ1K_aATAB&v=APEucNUSpxXdl176g1BmpaF0LX_s3P7Ytf_HudYfIf7UT6_BfK2QxpHfhGhSkKHKlkymO12T4yJO_FmyQ49XDSMAEHw4sO5iGRy4QrN2ksyL55aP_ad5KaBCva8AScsf4APu2hFmW0GJZiSvCP9fwDTnt-7kibzi9sjHw8lXh9DHkuAPz-SSWqk

Protocol

HTTP/1.1

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:50 GMT
AN-X-Request-Uuid: 3cbca1bf-3f4b-4f46-884d-0e763bb18c92
Server: nginx/1.21.3
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIU2ujVEsW9wwFRQsyd1oyc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 959A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D

170 B
188 B

20ms
20ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 30 Nov 2022 17:26:50 GMT
AN-X-Request-Uuid: 968614d7-ff35-408b-8f5c-7d4b903b71cf
Server: nginx/1.21.3
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTQyNzg2MjU2NzkyOTAzMjY3Mw%3D%3D
Connection: keep-alive
X-Proxy-Origin: 81.95.5.39; 81.95.5.39; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 252F 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1101219582749&version=m202209210101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 252F 0
20 B 41ms
41ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1101219582749&version=m202209210101&ct=77&x=1&cor=10505979272229304000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 252F 28 KB
17 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A4Bdpd2_oN8CBBxYEno9QAdu-_AtakThboedt4mdoy1HtiIfN-at8-Af5Qm3NFtRwlizppOGxrbJwcf6lbyTIBGgyXzoETetRvy6bqCt4oRfb4haSG1l33yaI0hMLuybL-wUH8OL5jKkf3Yg5LLJym1922Zk5i8HqhNvweLClHeliARiI&cry=1&dbm_d=AKAmf-Bz5ePMee-qIILwk1RxxIydci8igXNtboSlnyjYAuhwDtzs_tGfrTiYuv2H99QIwlEDPoN-iWK3TUofinT115NGDYtvg0rawTZOgdZizpiyUb5wkuXdwgSwGOl1jLyjoF75YdTgZ58Qs0yJcUe94M4sovfywMNTek0qbPNowjpm428khhxfnYgcQQAiVqUjHl97q6aI5oyHfSmelhV4s02D4DJCvcUtiK5lJBpEM213t2QKmBeEj9mGWFi53H8wuGnqGVNEnEamEDTWrrI_Vag4K9JHXAGYEFvF2JNZU8jAyyV9GG6t5Ao_Jv_ACpMMnKVzmZK-voUyVjr-yDyJdn8koVaJ2qFa7Z1vw7T9n--FFzf4O-umbhPyvXoHN1NBGS-WpfHDqLkXhJfw8mCBLO7h178RrTgcp7tRQG8gTA-hFWaKasls__HU3OwyUnQmNuVELFGuz0jfN6Dfb0KQK9st_5Ty5G9eouc0Y7ZOhHSMvUd7PqUES_R8egB13CWxj952Y3xdQsFIJ9qPgbfeCmXSrsmCnk177kHUhHmkWw-xu0PZ07eF563OEcCAjw8hcDuEX1V-Bks95N1pDDvVTviNLuz6E6qA_bo-NuB-SPjxEyIQH_DO7trHwUu119Ja7CsSUXe60IRcm6Bp5q645EnWX1KY1OmOt67rJzu0-SSohBDPB2PKghHXYyc7VfQj5afzS7XH3-PTh86gYYXyBOGi9B6Tjpoa0BN2Z97AOiWefSkV2VJXGXkTbS0rIe1wbXKx50PPv4t25Pk_YH-A-ywZ-qFp9JRF3DqpiYQ6Kz4Pc4tBNikA6XLt1m88mdq-fOtUnlePbhrSDdMpnQVY1TMI_NPQPbNdtD5djqN7kwjGhjxHPbcSFlosDxWjhrTKPpT0KfCUPFdUwVGMRCmLlr8DtgYhfVS1SSO8DFZjissqdIsPNma5GbNP3RXRMymqwnKvfg5QoAppKoEfYIaGsTxKLoZcilU4_cyrSqZuNybbX8TjxSRToBCsEpURAAfSsMU-rAVnt96ae92C_cqkDp23d0wKg9P-psJjtnkxmxpHFeNQCziW-Tcyhpf-Z98WYcBYANMDYRUOu1V4h4GOK4Jvhz7-s2nxLhOTFQD594wvbGZkpayrVr7AUPUWaK6dWPLaVkraFTuVev7b3zNcstK7XBlLMhgTK5dQ6Sc4b8_qUC3YPazcE3EICTpYk9_F8wXUSXypD2S__RteTdkoN3GYSoFmkwPCV3HDNRR2CVbeVtiYkQRGrkLQte3S-2U0Ic4Ficnf-yu3KvsvrMWrdjWAdkVdz_hJ_118c_fyPLPxUVK_fEpSx_4SfbDVNaCdbBpYgpUP-RZCWojxgZqCWFFwbepfxsO1DtifE9YfNUz3DqStUyCehlRAnLBq61psLDytFZYhgSYLJkbB7uzUXWBWi4i1S-fU_1W5EItchb2O6NpD0FdQHgnKeAd2Hx7PfRvuLqs5879s_dzdCyNgl-1hJE5QGU4ybOa9QH01q4L6aN3NbDymbkPWubcBTwhGalePo0aXNJ3Qq1cNtf_4SyVCgJSd8J6RnIh-owwLG4V18fJjXy-TX6V72M7l4oILCkpy2LAt5aZGOQYssZaTmIKkre96nuIhMuBfXXcIQEdHMHI9YCHkN22SUNB22SBZjmA9lK4j61SZ-4_mkQvQHkNNcUtctD0MrE3pbz7E5AkeVOitzketkrI3yc7P5aXYqwwzBj4EltM5MCIPgvvRhRdjdIMUNLO6_abcPhSuMk21S04-fQWRB58h04OC_7B1p7FABNV9BPHnlfJVksdIze8t9D1T115iPFquZg0RS2845sYvII5BCbf9_UADUBm1bB3iHybIeoJvI4LBFfR4xtgdJ0WueE5ApYVWOAVL7PhDcYk3R-LsvU213ezyUpYT_eOz3xSW9R6iDYFYshMugiZjorXtTzyamI5QIpJ5f3ueGlY-rJ3aERo8YLiyARVVGjTY9Rl0rsSefmw6zodw2veBxNh5myPHDCW0-tyEmqvFe9Fnjy2FvDh7vlKXTFHbUJaDS8wi_IXChZQg-jPC62bMPu7xnYOL31rnF7ipujN81rz3cyc-E8SLPFwFZvCzQDRFpWi2G4yK0dpj_6ooFcjZ4W_8QsGaCamyZJeZoFGwpItkCOMJQIj4JXRBjG537Tx9rxFRxQpC8fb4xa1I0R_vkKK0tYnkP2P7zON15f5gPfTswY8kugjVgPCXx0-CAPuYXO618hrQsKG3vNetc9C3cTmVIiFM6EgNdxtlWWPjMt0SaIXqxXN2qE-L0lLcoL6XsfHASrx822dBFyqikUP4288uluU7G85yabJL0e9I_Un9BLGcZG4qTnkpE_7p8ByPGPBnBWoNokPiG9834E9vXBNqJvxeeXM_8XsXENXIZECxz9wYh0xN97X3OkEeZICBbqs95ECCYOjZLnthlVUoLlSsSbphXHSnJ5R0PFJkbRIYjTxbEb03JEla-NYxHh8jDpVrmiTeH1nUuqqJv7AbdvULZef6brXc7jyoP5XIiiNHTS3v3Sbrs1TOTfHd6_fdOwuxdzda9txQaKpNFEnp39O2kG2aNyo7Hrrva7edjkHELa2RGZajr8O3PaTl169RO9U7Iw0CFWTdSt_n5LVu1JkWgkctxPSMStrnTyRyl5nlkrsuTY0p4J6gXmkMwtfELwW-bnG8O7mgOtuwPxv5sJMIXQJMcHYd89av187H8CVhufWKQRKJQ-mp9OTW6SSuridnZSEwhoyQHKxyLl9Gr3r2oz5k5vWRUTx1nMw6Jk93oR93tIVI4f77cZ5tHVYyfVLsecuHhvDgn5eVNgo--aLtHCkB2mq8cYzV3OQZwD3cAmi0urkABuYm6RqPLX7tA5APrI8fqcxZYCOYBRFZgiB71v5DbJh7XipPbB6gC-j_3uMSZfjYJltRn5zUppSFUe5UmRSNrpN3uaJ65n0SkowYpl4C5cXBZW4mwoAzDiXKm5sK_PMTp8TNypt-e1naedFVituUWxzXE6KecERfDGj_fytykciF55ALW4LNk4cgR6WpflWjKveTQGFWmcR0mMSJmQoBl_s4vwPmcJdH9S5GsYksfDXLYZ5RZcOM4Giyxyu2C8R3_pvFFHWfpTUXiuPB6UJ6NjT6cp8JAddFMj5EBq5jjL8NP_6z5psbynVRGXpgITwaavZRfh72ZAivYlPpQ9ssa5GGWP1AqZL7fOoDfgwgTcCdlYbzMzWdaZV21shbAKdhJx-AQchbh6sY6oJDkC2wgTLD4Tcx7FNLVioEIZY9aLOEUC7lcDUd3C4I4KrMAuA9CVh7haVaWEJp31NqhrWOXvgCpDuqq_A6VWSoCZ5Kmz5Y5UF35bDCP_q0SCj5Fo0ZWOEj42HmeIVMRd5_ddOUXzvMqFri1WKFHoCrPxtWQ797DmmomK83PApR0ORox-LhEl7IFCSDPM223QIUcZTkBexFr6UwDHKzFsQEPytwiaPlA5XpNL2FC8vLgBFskrYSONTHvEy8ixSNap582bxEy2-XerM82t6y9Duzx9pzjmdKOgdeFIMSDHzpTooT8-DWePPsp2lCXE6Nyf0vquDyBdUyNFWi5iRoG9wO98UnvNatL7Cewaefwl6rIXU4iOBJqtNRgrnLN7KXBgsU5NU9Oa8vq4MMj-8r-FKoLDhyn3jNJDbViUQBOR5adrxAdWNj1f3KBZzbtLdDLMg-IfofcRDnjKlbm-frDRcLKK1qpCldY_0ecdrlQkorXZFx6Cvhx1o-m2rUwOgR12T6_cslw5C4MNNokpulxOJCow&cid=CAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf_KdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Freceitas.ninja%2F&ds=l&xdt=1&iif=1&cor=10505979272229304000&adk=3690638929&idt=82&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c6913a93ac837b04f9f11e5c827306a56503c48453479c28b2eec90969494dcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17021
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/ Frame 252F 29 KB
11 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20221110/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A4Bdpd2_oN8CBBxYEno9QAdu-_AtakThboedt4mdoy1HtiIfN-at8-Af5Qm3NFtRwlizppOGxrbJwcf6lbyTIBGgyXzoETetRvy6bqCt4oRfb4haSG1l33yaI0hMLuybL-wUH8OL5jKkf3Yg5LLJym1922Zk5i8HqhNvweLClHeliARiI&cry=1&dbm_d=AKAmf-Bz5ePMee-qIILwk1RxxIydci8igXNtboSlnyjYAuhwDtzs_tGfrTiYuv2H99QIwlEDPoN-iWK3TUofinT115NGDYtvg0rawTZOgdZizpiyUb5wkuXdwgSwGOl1jLyjoF75YdTgZ58Qs0yJcUe94M4sovfywMNTek0qbPNowjpm428khhxfnYgcQQAiVqUjHl97q6aI5oyHfSmelhV4s02D4DJCvcUtiK5lJBpEM213t2QKmBeEj9mGWFi53H8wuGnqGVNEnEamEDTWrrI_Vag4K9JHXAGYEFvF2JNZU8jAyyV9GG6t5Ao_Jv_ACpMMnKVzmZK-voUyVjr-yDyJdn8koVaJ2qFa7Z1vw7T9n--FFzf4O-umbhPyvXoHN1NBGS-WpfHDqLkXhJfw8mCBLO7h178RrTgcp7tRQG8gTA-hFWaKasls__HU3OwyUnQmNuVELFGuz0jfN6Dfb0KQK9st_5Ty5G9eouc0Y7ZOhHSMvUd7PqUES_R8egB13CWxj952Y3xdQsFIJ9qPgbfeCmXSrsmCnk177kHUhHmkWw-xu0PZ07eF563OEcCAjw8hcDuEX1V-Bks95N1pDDvVTviNLuz6E6qA_bo-NuB-SPjxEyIQH_DO7trHwUu119Ja7CsSUXe60IRcm6Bp5q645EnWX1KY1OmOt67rJzu0-SSohBDPB2PKghHXYyc7VfQj5afzS7XH3-PTh86gYYXyBOGi9B6Tjpoa0BN2Z97AOiWefSkV2VJXGXkTbS0rIe1wbXKx50PPv4t25Pk_YH-A-ywZ-qFp9JRF3DqpiYQ6Kz4Pc4tBNikA6XLt1m88mdq-fOtUnlePbhrSDdMpnQVY1TMI_NPQPbNdtD5djqN7kwjGhjxHPbcSFlosDxWjhrTKPpT0KfCUPFdUwVGMRCmLlr8DtgYhfVS1SSO8DFZjissqdIsPNma5GbNP3RXRMymqwnKvfg5QoAppKoEfYIaGsTxKLoZcilU4_cyrSqZuNybbX8TjxSRToBCsEpURAAfSsMU-rAVnt96ae92C_cqkDp23d0wKg9P-psJjtnkxmxpHFeNQCziW-Tcyhpf-Z98WYcBYANMDYRUOu1V4h4GOK4Jvhz7-s2nxLhOTFQD594wvbGZkpayrVr7AUPUWaK6dWPLaVkraFTuVev7b3zNcstK7XBlLMhgTK5dQ6Sc4b8_qUC3YPazcE3EICTpYk9_F8wXUSXypD2S__RteTdkoN3GYSoFmkwPCV3HDNRR2CVbeVtiYkQRGrkLQte3S-2U0Ic4Ficnf-yu3KvsvrMWrdjWAdkVdz_hJ_118c_fyPLPxUVK_fEpSx_4SfbDVNaCdbBpYgpUP-RZCWojxgZqCWFFwbepfxsO1DtifE9YfNUz3DqStUyCehlRAnLBq61psLDytFZYhgSYLJkbB7uzUXWBWi4i1S-fU_1W5EItchb2O6NpD0FdQHgnKeAd2Hx7PfRvuLqs5879s_dzdCyNgl-1hJE5QGU4ybOa9QH01q4L6aN3NbDymbkPWubcBTwhGalePo0aXNJ3Qq1cNtf_4SyVCgJSd8J6RnIh-owwLG4V18fJjXy-TX6V72M7l4oILCkpy2LAt5aZGOQYssZaTmIKkre96nuIhMuBfXXcIQEdHMHI9YCHkN22SUNB22SBZjmA9lK4j61SZ-4_mkQvQHkNNcUtctD0MrE3pbz7E5AkeVOitzketkrI3yc7P5aXYqwwzBj4EltM5MCIPgvvRhRdjdIMUNLO6_abcPhSuMk21S04-fQWRB58h04OC_7B1p7FABNV9BPHnlfJVksdIze8t9D1T115iPFquZg0RS2845sYvII5BCbf9_UADUBm1bB3iHybIeoJvI4LBFfR4xtgdJ0WueE5ApYVWOAVL7PhDcYk3R-LsvU213ezyUpYT_eOz3xSW9R6iDYFYshMugiZjorXtTzyamI5QIpJ5f3ueGlY-rJ3aERo8YLiyARVVGjTY9Rl0rsSefmw6zodw2veBxNh5myPHDCW0-tyEmqvFe9Fnjy2FvDh7vlKXTFHbUJaDS8wi_IXChZQg-jPC62bMPu7xnYOL31rnF7ipujN81rz3cyc-E8SLPFwFZvCzQDRFpWi2G4yK0dpj_6ooFcjZ4W_8QsGaCamyZJeZoFGwpItkCOMJQIj4JXRBjG537Tx9rxFRxQpC8fb4xa1I0R_vkKK0tYnkP2P7zON15f5gPfTswY8kugjVgPCXx0-CAPuYXO618hrQsKG3vNetc9C3cTmVIiFM6EgNdxtlWWPjMt0SaIXqxXN2qE-L0lLcoL6XsfHASrx822dBFyqikUP4288uluU7G85yabJL0e9I_Un9BLGcZG4qTnkpE_7p8ByPGPBnBWoNokPiG9834E9vXBNqJvxeeXM_8XsXENXIZECxz9wYh0xN97X3OkEeZICBbqs95ECCYOjZLnthlVUoLlSsSbphXHSnJ5R0PFJkbRIYjTxbEb03JEla-NYxHh8jDpVrmiTeH1nUuqqJv7AbdvULZef6brXc7jyoP5XIiiNHTS3v3Sbrs1TOTfHd6_fdOwuxdzda9txQaKpNFEnp39O2kG2aNyo7Hrrva7edjkHELa2RGZajr8O3PaTl169RO9U7Iw0CFWTdSt_n5LVu1JkWgkctxPSMStrnTyRyl5nlkrsuTY0p4J6gXmkMwtfELwW-bnG8O7mgOtuwPxv5sJMIXQJMcHYd89av187H8CVhufWKQRKJQ-mp9OTW6SSuridnZSEwhoyQHKxyLl9Gr3r2oz5k5vWRUTx1nMw6Jk93oR93tIVI4f77cZ5tHVYyfVLsecuHhvDgn5eVNgo--aLtHCkB2mq8cYzV3OQZwD3cAmi0urkABuYm6RqPLX7tA5APrI8fqcxZYCOYBRFZgiB71v5DbJh7XipPbB6gC-j_3uMSZfjYJltRn5zUppSFUe5UmRSNrpN3uaJ65n0SkowYpl4C5cXBZW4mwoAzDiXKm5sK_PMTp8TNypt-e1naedFVituUWxzXE6KecERfDGj_fytykciF55ALW4LNk4cgR6WpflWjKveTQGFWmcR0mMSJmQoBl_s4vwPmcJdH9S5GsYksfDXLYZ5RZcOM4Giyxyu2C8R3_pvFFHWfpTUXiuPB6UJ6NjT6cp8JAddFMj5EBq5jjL8NP_6z5psbynVRGXpgITwaavZRfh72ZAivYlPpQ9ssa5GGWP1AqZL7fOoDfgwgTcCdlYbzMzWdaZV21shbAKdhJx-AQchbh6sY6oJDkC2wgTLD4Tcx7FNLVioEIZY9aLOEUC7lcDUd3C4I4KrMAuA9CVh7haVaWEJp31NqhrWOXvgCpDuqq_A6VWSoCZ5Kmz5Y5UF35bDCP_q0SCj5Fo0ZWOEj42HmeIVMRd5_ddOUXzvMqFri1WKFHoCrPxtWQ797DmmomK83PApR0ORox-LhEl7IFCSDPM223QIUcZTkBexFr6UwDHKzFsQEPytwiaPlA5XpNL2FC8vLgBFskrYSONTHvEy8ixSNap582bxEy2-XerM82t6y9Duzx9pzjmdKOgdeFIMSDHzpTooT8-DWePPsp2lCXE6Nyf0vquDyBdUyNFWi5iRoG9wO98UnvNatL7Cewaefwl6rIXU4iOBJqtNRgrnLN7KXBgsU5NU9Oa8vq4MMj-8r-FKoLDhyn3jNJDbViUQBOR5adrxAdWNj1f3KBZzbtLdDLMg-IfofcRDnjKlbm-frDRcLKK1qpCldY_0ecdrlQkorXZFx6Cvhx1o-m2rUwOgR12T6_cslw5C4MNNokpulxOJCow&cid=CAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf_KdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw&dv3_ver=m202209210101&rfl=https%3A%2F%2Freceitas.ninja%2F&ds=l&xdt=1&iif=1&cor=10505979272229304000&adk=3690638929&idt=82&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2c19d105106bf6f55dd15da3523b88f88921e03cf54e1efaa138922fc12397c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 12:22:13 GMT
content-encoding: br
x-content-type-options: nosniff
age: 18277
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11206
x-xss-protection: 0
server: cafe
etag: 16690196781007480285
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Dec 2022 12:22:13 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 252F 41 KB
15 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Mon, 28 Nov 2022 12:22:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191076
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 28 Nov 2023 12:22:14 GMT

GET
H2 200 banner Show response
ad1.adfarm1.adition.com/ Frame 252F 12 KB
5 KB 17ms
17ms Script
text/javascript 217.79.188.2
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://ad1.adfarm1.adition.com/banner?sid=4745913&adjsver=3&fvers=&iframe=1&ref=https%3A//receitas.ninja/&ro=https%3A//b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html&uao=Mozilla/5.0%20%28Windows%20NT%2010.0%3B%20Win64%3B%20x64%29%20AppleWebKit/537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome/108.0.5359.71%20Safari/537.36&os=17&browser=11&userid=7171861842566051987&kid=5585645&screen_res=6&wpt=J&clickurl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3D
Requested by: Host: ad1.adfarm1.adition.com
URL: https://ad1.adfarm1.adition.com/js?wp_id=4745913&gdpr=&gdpr_consent=&kid=5585645&clickurl=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK-j7_UP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi-VjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9_yTLu61QQ2H-ZjL1G5OkL6ntaixgvh9tu1O8vheV-RVaUa9R4_GTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC-tjWhjuAmLizLa71HzN-oy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L-UKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe-f8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu-rHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08-3fAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf_KdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64_3uCW10ThkFO3xbh_LybvxPrwNjvw%26client%3Dca-pub-4894209870857905%26dbm_c%3DAKAmf-Aj-otENwqpMt-v6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb-bOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm_d%3DAKAmf-CBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6-IPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO-jCsNKZ0CmohSsb2bOe6NtxxCOQqQ-hzl0V_nkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF_EKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI_8sG2OXPdf_PfBi9fhtur4iu_ZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv-_3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs_dMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi_sieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R-UbUGiaCHxBtSdDY2ZuA75tqXmDelU-bJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb_pxvgvqaWjUNQvIpJXRpnFi3UeL-NDyccjVHE80xkMVidRlyUL_InldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi_mSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 217.79.188.2 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: ad1.adfarm1.adition.com
Software: ADITIONSERVER v1.0 /
Resource Hash: 0c2a0d26867811365273882a2d44b58c3c124881b09caf705e92909cd9e3b709

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 18:26:50 +0100
content-encoding: gzip
server: ADITIONSERVER v1.0
p3p: policyref="https://imagesrv.adition.com/w3c/p3p-ssl.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"
content-type: text/javascript
cache-control: no-cache
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 8B3C 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:82f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 133264
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 29 Nov 2022 04:25:46 GMT
expires: Wed, 29 Nov 2023 04:25:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js Show response
pagead2.googlesyndication.com/bg/ Frame 8B3C 36 KB
16 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Cy76TGYNwlBdeFKzRh_Qc2a075RKB_J9dWAUlCdaUYI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b2efa4c660dc2505d7852b3461fd07366b4ef944a07f27d75601494275a5182

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 16:56:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1828
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15969
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 Nov 2023 16:56:22 GMT

GET
H2 200 index.html Show response
imagesrv.adition.com/banners/3618/16920996/ Frame 83F8 20 KB
3 KB 13ms
12ms Document
text/html 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Requested by: Host: receitas.ninja
URL: https://receitas.ninja/saque-fgts/?utm_source=active&utm_medium=email&utm_campaign=gl_email&vgo_ee=la0mWY9L09qjIafZtiHklRyFMBziVFK8anrdALczvaw%3D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 615b4cdc0fc373544269aebbc292e2b2ab40f35f4a4dea18983d863e313f1676

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
content-encoding: br
content-length: 3209
content-type: text/html
date: Wed, 30 Nov 2022 17:26:50 GMT
etag: "1446271729-br"
last-modified: Fri, 18 Nov 2022 15:42:54 GMT
vary: Accept-Encoding

GET
H/1.1

200
OK

px.gif Show response
d.adtriba.com/ Frame 252F
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=e774d0b4&atb_dpuid=nayoki&atb_dcaid=display.start11_perfor_adbdl
https://d.adtriba.com/px.gif

42 B
227 B

9ms
8ms

Script
image/gif

3.73.210.71
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 3.73.210.71 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-73-210-71.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Date: Wed, 30 Nov 2022 17:26:50 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Wed, 30 Nov 2022 17:26:50 GMT
Last-Modified: Wed, 30 Nov 2022 17:26:50 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H2 200 AditionH5_ClickTags.js Show response
imagesrv.adition.com/js/ Frame 83F8 753 B
407 B 13ms
13ms Script
application/javascript 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/js/AditionH5_ClickTags.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 5a0cecf509251de7b796c7c34ca1374bbb3fabe582e9e9394f1a1ebd9d421997

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:50 GMT
content-encoding: br
last-modified: Thu, 20 Aug 2020 14:03:40 GMT
etag: "1134380014-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 330

GET
H2 200 de7d7f80ef52d4179c11391f3f17d834.js Show response
imagesrv.adition.com/banners/3618/16920996/ Frame 83F8 59 KB
14 KB 14ms
13ms Script
application/javascript 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to

Full URL: https://imagesrv.adition.com/banners/3618/16920996/de7d7f80ef52d4179c11391f3f17d834.js
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: bcfae509d3506c7ff769dd3eed0347b0257511b13afe2cccc417a65406eaac45

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

date: Wed, 30 Nov 2022 17:26:50 GMT
content-encoding: br
last-modified: Fri, 18 Nov 2022 15:25:35 GMT
etag: "1404835225-br"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
accept-ranges: bytes
content-length: 14269

GET
H2 200 b2d7d8d48d3df04fa21f3e3520cc96cd.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 2 KB
2 KB 12ms
11ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/b2d7d8d48d3df04fa21f3e3520cc96cd.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 2949ad87f5759aa23a8447e1f38f53f4003bc7f30da5b2e7b65db2f687dd4dfc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Mon, 06 Jun 2022 08:57:30 GMT
accept-ranges: bytes
etag: "1264739588"
content-length: 1758
content-type: image/svg+xml

GET
H2 200 ac4848f5dbf9aff1f6f13ddd9583fb81.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 13 KB
13 KB 13ms
11ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/ac4848f5dbf9aff1f6f13ddd9583fb81.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 63faa8b7384c37c4834b77615586404ad7d7591d5ab8ac0c50c2b10470b35b0b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Wed, 16 Nov 2022 12:35:48 GMT
accept-ranges: bytes
etag: "675566260"
content-length: 13735
content-type: image/svg+xml

GET
H2 200 8ed7468fe745b87d9fc742f0a89d88e4.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 21 KB
21 KB 13ms
12ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/8ed7468fe745b87d9fc742f0a89d88e4.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 0a3c785d054d71dc1508ce8ea6d336190764d94287722c574c806b0caf7b1edb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Fri, 18 Nov 2022 15:25:35 GMT
accept-ranges: bytes
etag: "2861700501"
content-length: 21802
content-type: image/svg+xml

GET
H2 200 7f9f6a078afe2655d1ab000d87022fa3.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 12 KB
12 KB 22ms
21ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/7f9f6a078afe2655d1ab000d87022fa3.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: a3778dc766994a8bfa4e68a8a44f1ac4a2824fbb10ec890e20096d7b3168cd5e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Fri, 18 Nov 2022 14:45:21 GMT
accept-ranges: bytes
etag: "90680741"
content-length: 11915
content-type: image/svg+xml

GET
H2 200 b50e9936a36ec50859d493ece2c9a5af.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 932 B
1007 B 23ms
22ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/b50e9936a36ec50859d493ece2c9a5af.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 5a23ea6be465e25445e367b045e14b5247d633c2a3bde97f1faf5c8d01e77ab5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Fri, 18 Nov 2022 14:45:21 GMT
accept-ranges: bytes
etag: "2893344044"
content-length: 932
content-type: image/svg+xml

GET
H2 200 aa41380fe883e0e7b6043dbc453e4aa7.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 3 KB
3 KB 23ms
22ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/aa41380fe883e0e7b6043dbc453e4aa7.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 61565d1a5bef549b046bf8b8569fec06f0392607c1ba2082b5909db33a8da2c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Fri, 18 Nov 2022 15:25:35 GMT
accept-ranges: bytes
etag: "1271665344"
content-length: 3457
content-type: image/svg+xml

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D274 1 KB
644 B 8ms
8ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 24164
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 30 Nov 2022 10:44:06 GMT
etag: 48472445140208031
expires: Thu, 01 Dec 2022 10:44:06 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 252F 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f5a3a86c313a5d375f0cca9886f59ee0f4a7e9ded553e53f2d24bf28c4d1f057

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bfb145a64f74e892297169fa60a74aa1.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 44 KB
44 KB 12ms
11ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/bfb145a64f74e892297169fa60a74aa1.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 7445b15985bff8d1911cf49ade51d502ac43f40063b0cec581a4c6a03aeb7134

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Wed, 16 Nov 2022 12:35:48 GMT
accept-ranges: bytes
etag: "1782928541"
content-length: 45367
content-type: image/svg+xml

GET
H2 200 937102bae455ccc8e4f2bd6319641179.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 11 KB
11 KB 13ms
12ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/937102bae455ccc8e4f2bd6319641179.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 73598033031dd6cff6948a2c8a6c5f0512b48b3ffa2349c405f819f7bfb00c35

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Fri, 18 Nov 2022 15:25:35 GMT
accept-ranges: bytes
etag: "893670381"
content-length: 11473
content-type: image/svg+xml

GET
H2 200 c05a8033bfdb6f2ebec1e8d7639a675e.svg
imagesrv.adition.com/banners/3618/16920996/media/ Frame 83F8 3 KB
4 KB 13ms
13ms Image
image/svg+xml 217.79.188.60
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://imagesrv.adition.com/banners/3618/16920996/media/c05a8033bfdb6f2ebec1e8d7639a675e.svg
Requested by: Host: imagesrv.adition.com
URL: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 217.79.188.60 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),
Reverse DNS: imagesrv.adition.com
Software: /
Resource Hash: 746fd2052c5b1c7246901063f555c250d625364ae39402c2e77911a208dbca9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imagesrv.adition.com/banners/3618/16920996/index.html?clicktag=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCtkFoWJKHY5GVPK%2Dj7%5FUP8pWoqAOHkNq8bfGsv937EPAuEAEgpJ2XjwFglYKAgJgHoAH0i5KgAcgBCakC6WENi%2DVjsT6oAwGqBI8CT9CwgTVC6jZ3tM0pZWseV1QFuQm9%5FyTLu61QQ2H%2DZjL1G5OkL6ntaixgvh9tu1O8vheV%2DRVaUa9R4%5FGTUmvYJ56c6kVd6iEqvNNOmPNOoXFGwGSciXOj4n5Sx6i9NC9EtYfzaWA5ZC%2DtjWhjuAmLizLa71HzN%2Doy41PVsyr0ZB1997xDPTPzkJJLDtUxapv1guRUkZOhnDiJPBEND2H9f3L%2DUKMQ2yjV3vRQAiZ8mcbgtltzC6qh9crW6GGU2UdNKOVnqlU9GXh3wVZLre5lJRe%2Df8TTUaUvQJTsIk5LcAAFq5Oun3CDIOzu%2DrHmVrLkIIa8VO3RmBicOlcD7VtqQjnYEOHfsYYgwSFe1FDjF8AEnI79g5cE4AQDkAYBoAZNgAf08%2D3fAqgHjs4bqAeT2BuoB%2D6WsQKoB%5F6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB%5F%2DesQKoB9%2DfsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATk4OzEdATANgTDYgUAdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSOwDq26N9l4HW7BnLKHw2dN5OC5AkH5BdFqxgXPf%5FKdGVL2Dtn1nDAPMYxlPoCAy3shGFzJnhGFoPSv3qGAEgEw%26sig%3DAOD64%5F3uCW10ThkFO3xbh%5FLybvxPrwNjvw%26client%3Dca%2Dpub%2D4894209870857905%26dbm%5Fc%3DAKAmf%2DAj%2DotENwqpMt%2Dv6YJtoMRjQKTl3IAV6Xp9Joo5sZYHmv7q2jWPcQHb4oRk2UIx65EnmlnVBRystraKnrFnYxfTkhY7DIb%2DbOTgKz3RkCD5LiRKERGUhRifctvBz2YGXGw5cfPSbZ7uxZC0vVChCIj06z4TswFf4iKSWqUSx36mzvjuIPs%26cry%3D1%26dbm%5Fd%3DAKAmf%2DCBrWtiwtvp7uP68OVbKdHquiDOFWj9f7KUwmXj6%2DIPLPGb49nU4iLWS9d7qahgOCI2Uf32EiXUsNrzHNa3pXbRVi0qxKO%2DjCsNKZ0CmohSsb2bOe6NtxxCOQqQ%2Dhzl0V%5FnkZp2vXaFWo7ELfNN9ECyb5byyjgr0RoFdFdF%5FEKbnBbmc2AuFzZ2T5etNs2yBlH9JlGWd2PE9ahYYFLJAkUmxDCQqfEI%5F8sG2OXPdf%5FPfBi9fhtur4iu%5FZvAtZ4l07TgyOA3GaQlzPRo1gyQasBijcWWizLGm9p1kj3bOVZ3HyprxRADox78qb2CV9z92krRt4GhLv%2D%5F3RmMNaM0VlEN0DT6Dayu18UoZhsUhfJosk1yHFPCKIcSgAWs%5FdMpXJNaAFAqv3s6tdLlaDULjB5J6SU4Lg2qJl4zeCY9K1bBaatJi%5FsieQOnkGiGVEfwkO7oEbUwTABCev341G5PU4fNzpc6li7v1Ap6OoKDw0O92R%2DUbUGiaCHxBtSdDY2ZuA75tqXmDelU%2DbJ0UcVOs4nnKWpLpPTPaYss82mPjj9VURNXSAIeKShXlyoQfgcNtgE9sb%5FpxvgvqaWjUNQvIpJXRpnFi3UeL%2DNDyccjVHE80xkMVidRlyUL%5FInldqxIsUWntymhky9Mhj9H66DcO8PQLI9pSC6kaMw2yOJiHEpi%5FmSgi1eWMYu8AxKPUi9ar1XwEX8r%26adurl%3Dhttps%253A%252F%252Fad1.adfarm1.adition.com%252Fredi%253Flid%253D7171861846877406417%2526gdpr%253D0%2526gdpr%255Fconsent%253D%2526gdpr%255Fpd%253D0%2526userid%253D7171861842566051987%2526sid%253D4745913%2526kid%253D5585645%2526bid%253D16920996%2526c%253D36909%2526keyword%253D%2526sr%253D6%2526gk%253D0%2526mdev%253D0%2526clickurl%253D&gdpr=0&gdpr_consent=&h5Params=%7B%7D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 30 Nov 2022 17:26:50 GMT
last-modified: Fri, 18 Nov 2022 14:45:21 GMT
accept-ranges: bytes
etag: "3385290246"
content-length: 3550
content-type: image/svg+xml

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D274
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEH4xFmxitqCOZ5oKP0hG33Y&google_cver=1&google_push=ASkJ3FZY59boDYptBuwlHGPC8cYW9m6QWhPNXoYvs0Xl4psf-zUkfWdHxk...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FZY59boDYptBuwlHGPC8cYW9m6QWhPNXoYvs0Xl4psf-zUkfWdHxk8X7yWwq47dZSh7LFGnWMsU4e5XHiXNghcFZ9-t6zN8&google_hm=lHonUqOfv_TI...

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FZY59boDYptBuwlHGPC8cYW9m6QWhPNXoYvs0Xl4psf-zUkfWdHxk8X7yWwq47dZSh7LFGnWMsU4e5XHiXNghcFZ9-t6zN8&google_hm=lHonUqOfv_TIhNA_vmcsPw

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ASkJ3FZY59boDYptBuwlHGPC8cYW9m6QWhPNXoYvs0Xl4psf-zUkfWdHxk8X7yWwq47dZSh7LFGnWMsU4e5XHiXNghcFZ9-t6zN8&google_hm=lHonUqOfv_TIhNA_vmcsPw
pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D274
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECseMfNqgD-fLUY2GPP1XD4&google_push=ASkJ3FZVoMbDHEJuhf2lPug68ZUti4NG5edaOjgHBPxcsELd-STECrJ-KR...

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECseMfNqgD-fLUY2GPP1XD4&google_push=ASkJ3FZVoMbDHEJuhf2lPug68ZUti4NG5edaOjgHBPxcsELd-STECrJ-KRvLzRVxF95FaPRdZDcYwzQqr7GiZRQ-bCMJFTURQ8Y

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-hhn4036-HHN
pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1669829211.654990,VS0,VE89
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESECseMfNqgD-fLUY2GPP1XD4&google_push=ASkJ3FZVoMbDHEJuhf2lPug68ZUti4NG5edaOjgHBPxcsELd-STECrJ-KRvLzRVxF95FaPRdZDcYwzQqr7GiZRQ-bCMJFTURQ8Y
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D274
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEHMwDYSVm46OOATiA0FPqxY&google_cver=1&google_push=ASkJ3FYFvSb6okeRKaSIarhSPFkDuwVdKP_-kDluPUgSRZKLJ_wZBUMDy1uGyKUpsfzadPgsGoThi6qtPcIO4K5OnWBKI6IRLD9D
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=31021A52349C421DA05466022213AB12&google_push=ASkJ3FYFvSb6okeRKaSIarhSPFkDuwVdKP_-kDluPUgSRZKLJ_wZBUMDy1uGyKUpsfzadPgsGoThi6qtPcIO4K5...

170 B
188 B

19ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=31021A52349C421DA05466022213AB12&google_push=ASkJ3FYFvSb6okeRKaSIarhSPFkDuwVdKP_-kDluPUgSRZKLJ_wZBUMDy1uGyKUpsfzadPgsGoThi6qtPcIO4K5OnWBKI6IRLD9D

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 30 Nov 2022 17:26:50 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=31021A52349C421DA05466022213AB12&google_push=ASkJ3FYFvSb6okeRKaSIarhSPFkDuwVdKP_-kDluPUgSRZKLJ_wZBUMDy1uGyKUpsfzadPgsGoThi6qtPcIO4K5OnWBKI6IRLD9D
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 29 Nov 2022 17:26:50 GMT

GET
H3 200 dds
rtb.openx.net/sync/ Frame D274 43 B
64 B 45ms
33ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH_5__jLDKt2Cqm2f54-Hpo&google_cver=1&google_push=ASkJ3Fascq6Ky5gs9gmNGNSZ0ejHoxyPJOKBwkPQUNtHnd_oE8LoTCNfBnL4qAnAqv-9NPNWlVq8VC8lJU8n6YnYNCuMX-vFsgVq
Requested by: Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 8q64fg185bsl1kumonsred3d4922bp70

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D274
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=oLxexvhpT92W5lojBuDNTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

20ms
19ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=oLxexvhpT92W5lojBuDNTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FbbAZTiPq48TxmGPuSsD9qm0go_KgwMfxQ_EsLYyp495VahscUNZ_x3j24jmYG2H4FoCrEE-_icb_WGl7yG0Dt7_-QNambm

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=oLxexvhpT92W5lojBuDNTQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ASkJ3FbbAZTiPq48TxmGPuSsD9qm0go_KgwMfxQ_EsLYyp495VahscUNZ_x3j24jmYG2H4FoCrEE-_icb_WGl7yG0Dt7_-QNambm
date: Wed, 30 Nov 2022 17:26:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D274
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJxw1bMVVcI_wXG2uP94x-g&google_cver=1&google_push=ASkJ3FbRnA5eVJg1KVXfHAo7ZDUW0T_CeAG2NFfClHWSPDxcb94tligKcdvTCBcD0SPGvX-ffT...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJxw1bMVVcI_wXG2uP94x-g&google_cver=1&google_push=ASkJ3FbRnA5eVJg1KVXfHAo7ZDUW0T_CeAG2NFfClHWSPDxcb94tligKcdvTCBcD0SPGvX-ffT...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1TZDIwckFGRTJ1RnlRVV9KeWc2a0RlY19WQzFSRDRzT35B&google_push=ASkJ3FbRnA5eVJg1KVXfHAo7ZDUW0T_CeAG2NFfClHWSPDxcb94tligKc...

170 B
188 B

20ms
20ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1TZDIwckFGRTJ1RnlRVV9KeWc2a0RlY19WQzFSRDRzT35B&google_push=ASkJ3FbRnA5eVJg1KVXfHAo7ZDUW0T_CeAG2NFfClHWSPDxcb94tligKcdvTCBcD0SPGvX-ffTi7WBlQ1DofG3YAptWmCuf5T1eQoA

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1TZDIwckFGRTJ1RnlRVV9KeWc2a0RlY19WQzFSRDRzT35B&google_push=ASkJ3FbRnA5eVJg1KVXfHAo7ZDUW0T_CeAG2NFfClHWSPDxcb94tligKcdvTCBcD0SPGvX-ffTi7WBlQ1DofG3YAptWmCuf5T1eQoA
date: Wed, 30 Nov 2022 17:26:50 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame D274
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEFheu7P95LgZ5CIvshkSkaU&google_cver=1&google_push=ASkJ3FZ0sCQ-QLufHrcO-bY-NK51kPrucn8Qeo4elzVGhsbdzgYmpoCs2OgL2MZHDHo-mjKbPPBo9YRV1d1...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ASkJ3FZ0sCQ-QLufHrcO-bY-NK51kPrucn8Qeo4elzVGhsbdzgYmpoCs2OgL2MZHDHo-mjKbPPBo9YRV1d1F1Mr1YC3ZSPoIas39qQ
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

9ms
8ms

Image
text/plain

51.89.9.253
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Protocol

Server

51.89.9.253 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip253.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.71 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Wed, 30 Nov 2022 17:26:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D274 0
12 B 17ms
16ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Kw4FLgx4UkWorBHsN4Q9FfPGMYSPrk7YA8YDJH2CFPzzohltrVKT_hpUI9d02o4WWH5c48znI

Requested by

Host: b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com
URL: https://b1ce408ebeb46dbd28b3c0042130306d.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS