pastelink.net Open in urlscan Pro
178.79.155.87  Public Scan

7 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 50

• https://ad10.ad-srv.net/request.php?zone=8e93336o9ddx&nw=14&renderingType=javascript&namespace=09096f845a&subid=&uid=20dba1b30a300019&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=ANIM_AFTER_30S%3A0&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3Dhttp%253A%252F%252Fbrain.rvty.net%252FRTB%252FClick%253Fx%253DEASY-X-COORDINATE%2526y%253DEASY-Y-COORDINATE%2526s%253D97944753%2526a%253D146072%2526t%253D1631841294616%2526l%253D662259%2526p%253D3%2526appid%253D%2526aa%253D6143ec0e-0005-ee6a-08bb-c6b64501ab24%2526gdpr%253D1%2526gdpr_consent%253D%2526dest%253D&documentReferer=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2F&ancestorOrigins=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fpastelink.net&random=7705380064158&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
• https://ad10.ad-srv.net/request.php?zone=8e93336o9ddx&nw=14&renderingType=javascript&namespace=09096f845a&subid=&uid=20dba1b30a300019&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=ANIM_AFTER_30S%3A0&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3Dhttp%253A%252F%252Fbrain.rvty.net%252FRTB%252FClick%253Fx%253DEASY-X-COORDINATE%2526y%253DEASY-Y-COORDINATE%2526s%253D97944753%2526a%253D146072%2526t%253D1631841294616%2526l%253D662259%2526p%253D3%2526appid%253D%2526aa%253D6143ec0e-0005-ee6a-08bb-c6b64501ab24%2526gdpr%253D1%2526gdpr_consent%253D%2526dest%253D&documentReferer=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2F&ancestorOrigins=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fpastelink.net&random=7705380064158&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 52

• https://www.awin1.com/cshow.php?s=2470174&v=11354&q=371933&r=278235&pv=1&pref1=96489300013399201324213011720010&gdpr=&gdpr_consent= HTTP 302
• https://www.zenaps.com/cshow.php?pvr=aab14a00-1754-11ec-a5f3-692d0d349c1f&v=11354&r=278235&q=371933&s=2470174&viewref=96489300013399201324213011720010&pv=1&gdpr=&gdpr_consent= HTTP 302
• https://www.conrad.de/ztpv.php?awc=11354_278235_1631841295_aab14a00-1754-11ec-a5f3-692d0d349c1f&insert=AW

Request Chain 55

• https://www.awin1.com/cshow.php?s=2470174&v=11354&q=371933&r=278235&pref1=96489300013399201324213011720010&gdpr=&gdpr_consent= HTTP 302
• https://www.zenaps.com/cshow.php?pvr=aab14a00-1754-11ec-a85c-692d033a3c28&v=11354&r=278235&q=371933&s=2470174&viewref=96489300013399201324213011720010&gdpr=&gdpr_consent= HTTP 302
• https://asset.conrad.com/media10/isa/160267/c1/-/de/Bosch2021_728x90?format=gif

59 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
3 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request 3f1xe Show response pastelink.net/	15 KB 6 KB	90ms 53ms	Document text/html	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 99195205ea538ec0bf57b18adbd181b5f2678de902befc9351dfbe9e66aa154c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :method GET :authority pastelink.net :scheme https :path /3f1xe pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Response headers server nginx date Fri, 17 Sep 2021 01:14:53 GMT content-type text/html; charset=UTF-8 set-cookie PHPSESSID=8135vu1nr4tbljg7qrgp5e2abb; secure; HttpOnly expires Thu, 19 Nov 1981 08:52:00 GMT cache-control no-store, no-cache, must-revalidate pragma no-cache strict-transport-security max-age=31536000; includeSubDomains content-encoding gzip
GET H2	200	css2 fonts.googleapis.com/	5 KB 1 KB	148ms 29ms	Stylesheet text/css	142.250.186.170 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.170 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s08-in-f10.1e100.net Software ESF / Resource Hash 2c243eeac8e9c04aaddb3a8d759ab9b535faf21f7b292e61458ee5e45cb8a02a Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=31536000 content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" x-xss-protection 0 last-modified Thu, 16 Sep 2021 23:54:09 GMT server ESF date Fri, 17 Sep 2021 01:14:53 GMT x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Fri, 17 Sep 2021 01:14:53 GMT
GET H2	200	styles.css pastelink.net/assets/css/	188 KB 188 KB	34ms 33ms	Stylesheet text/css	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://pastelink.net/assets/css/styles.css?q=8 Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 4d5981c66d2261b78d59b3492d8dc0dca1678de1da3f3eb99e34ab488dc0be9b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :path /assets/css/styles.css?q=8 pragma no-cache cookie PHPSESSID=8135vu1nr4tbljg7qrgp5e2abb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept text/css,*/*;q=0.1 cache-control no-cache sec-fetch-dest style :authority pastelink.net referer https://pastelink.net/3f1xe :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/3f1xe User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT last-modified Tue, 17 Aug 2021 16:49:07 GMT server nginx etag "611be883-2eec1" strict-transport-security max-age=31536000; includeSubDomains content-type text/css accept-ranges bytes content-length 192193
GET H2	200	jquery-3.6.0.min.js Show response code.jquery.com/	87 KB 30 KB	137ms 18ms	Script application/javascript	69.16.175.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.6.0.min.js Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_128_GCM Server 69.16.175.42 , United States, ASN20446 (HIGHWINDS3, US), Reverse DNS hwcdn.net Software nginx / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Request headers Referer https://pastelink.net/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT content-encoding gzip last-modified Tue, 02 Mar 2021 17:27:20 GMT server nginx etag W/"603e7578-15d9d" vary Accept-Encoding x-hw 1631841293.dop248.am5.t,1631841293.cds297.am5.hn,1631841293.cds007.am5.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30875
GET H2	200	script.min.js Show response pastelink.net/assets/js/	28 KB 28 KB	17ms 17ms	Script application/javascript	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Full URL https://pastelink.net/assets/js/script.min.js?q=8 Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 71f753f75061220e704bbaa0fbe2709773d104faafec4530c87499af5cd53684 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :path /assets/js/script.min.js?q=8 pragma no-cache cookie PHPSESSID=8135vu1nr4tbljg7qrgp5e2abb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept */* cache-control no-cache sec-fetch-dest script :authority pastelink.net referer https://pastelink.net/3f1xe :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/3f1xe User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT last-modified Wed, 11 Aug 2021 17:29:10 GMT server nginx etag "611408e6-6eb1" strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript accept-ranges bytes content-length 28337
GET H2	200	js.cookie.min.js Show response cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/	2 KB 2 KB	131ms 14ms	Script application/javascript	104.16.18.94 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/js-cookie/latest/js.cookie.min.js Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.16.18.94 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4b6d244a569a8befc0b901e3dca8e82f19b188e2d3e76f7c62fce96935ed6311 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 3609863 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 content-length 772 timing-allow-origin * last-modified Mon, 04 May 2020 16:11:49 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03ec5-6d7" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" strict-transport-security max-age=15780000 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G7Um3xHpAEeen0awXHezdx70VuJTDXebbQ4vXJ%2B3R2Yjn6gyp2uarLPX4uy2TmKhbQJYaFD5EnvxVVIbeWZxkZjFhDcVvIT5DWUUOjXlwJ%2FQgWEkc0skl2K1%2BY3GuIkfyROqBoaD"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * vary Accept-Encoding cache-control public, max-age=30672000 accept-ranges bytes cf-ray 68fe7af6b9e921bd-DUS expires Wed, 07 Sep 2022 01:14:53 GMT
GET H2	200	rules.js Show response cdn.adligature.com/pl/prod/	9 KB 3 KB	139ms 21ms	Script application/javascript	172.67.202.177 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.adligature.com/pl/prod/rules.js Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 57b7a706d6e74f45aa3f8fc8aa306d6b925688c4aabfc6a1b922e3e7291dbe5b Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-goog-hash crc32c=Q/L+Wg==, md5=5Z2Sge8XnnVGQXKIJ43A9Q== date Fri, 17 Sep 2021 01:14:53 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 200 cf-polished origSize=17169 x-guploader-uploadid ADPycduy0w-xY5qmcFHe2N4ZspNhCroDFdo9hnLL6S6iPJo03Yj3Xqkr7dkzWm7-ije209L_-9VMXfR5jtiapR0-MV-moGkmEA x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity cf-bgj minify alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Thu, 16 Sep 2021 16:43:30 GMT server cloudflare etag W/"e59d9281ef179e7546417288278dc0f5" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZGN4BJtt00FTDGl2zl%2FpB3X4Ie2iC7i8II%2BpbNk7Aj2pUZTe0V2qvs70KdA9oZfYeBBoS7WyvTgS51PkaqlAxsmnzLochWQDoV0UEkzmDAqg5HroSqtTuhz%2Feo6qi%2BwfroSXx3s%3D"}],"group":"cf-nel","max_age":604800} x-goog-generation 1631810610846839 content-type application/javascript cache-control public, max-age=1800, s-maxage=600, must-revalidate x-goog-stored-content-length 17169 cf-ray 68fe7af6ba58409f-CDG expires Fri, 17 Sep 2021 01:21:33 GMT
GET H2	200	api.js Show response www.google.com/recaptcha/	850 B 991 B	77ms 29ms	Script text/javascript	142.250.185.68 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.68 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f4.1e100.net Software GSE / Resource Hash f6851d9ce8f7d3b11d1784de142969571cc8a1de4bb59e0f1259fab7d5f40dc4 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT content-encoding gzip x-content-type-options nosniff server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin content-security-policy frame-ancestors 'self' alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 557 x-xss-protection 1; mode=block expires Fri, 17 Sep 2021 01:14:53 GMT
GET H2	200	pastelinknet4.jpg pastelink.net/assets/images/	12 KB 12 KB	18ms 17ms	Image image/jpeg	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/pastelinknet4.jpg Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 262b2a0bae52d6afe2f44127d9e9bf02205ad9d02d6be840f0b8440a45db0f19 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :path /assets/images/pastelinknet4.jpg pragma no-cache cookie PHPSESSID=8135vu1nr4tbljg7qrgp5e2abb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority pastelink.net referer https://pastelink.net/3f1xe :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/3f1xe User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT last-modified Thu, 27 May 2021 10:51:09 GMT server nginx etag "60af799d-2ffc" strict-transport-security max-age=31536000; includeSubDomains content-type image/jpeg accept-ranges bytes content-length 12284
GET H2	200	public.png pastelink.net/assets/images/	609 B 775 B	19ms 17ms	Image image/png	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/public.png Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 04bcd86676a40009fe53606bce88edf13537b712f218f9c6057e97c612513092 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :path /assets/images/public.png pragma no-cache cookie PHPSESSID=8135vu1nr4tbljg7qrgp5e2abb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority pastelink.net referer https://pastelink.net/3f1xe :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/3f1xe User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT last-modified Thu, 27 May 2021 10:51:10 GMT server nginx etag "60af799e-261" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 609
GET H2	200	gtm.js Show response www.googletagmanager.com/	182 KB 63 KB	92ms 32ms	Script application/javascript	142.250.185.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.232 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f8.1e100.net Software Google Tag Manager / Resource Hash 696aeda8b3bedf6b5d164efa72674baf35abbe233008363f86db2eb9da588ede Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 63578 x-xss-protection 0 last-modified Fri, 17 Sep 2021 00:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Fri, 17 Sep 2021 01:14:53 GMT
GET H2	200	advally-4.8.1.js Show response cdn.adligature.com/rules.js/	90 KB 24 KB	24ms 23ms	Script application/javascript	172.67.202.177 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.adligature.com/rules.js/advally-4.8.1.js Requested by Host: cdn.adligature.com URL: https://cdn.adligature.com/pl/prod/rules.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 67abcd0331c766735b7bf9b946abb096d0465fe4c609335f68a928be16bdf9d3 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-goog-hash crc32c=HTxjvA==, md5=zEXv8K8/sSRGJJzlga3bcw== date Fri, 17 Sep 2021 01:14:53 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 3080 cf-polished origSize=153261 x-guploader-uploadid ADPycduM1H238svdlXCoo7Byb4EwQHuKknl8XvBdJrGGO5g-7C-8shTKF87FgO39D-riLiok3KY65unsRaK7t-16dR0 x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Tue, 14 Sep 2021 20:14:29 GMT server cloudflare etag W/"cc45eff0af3fb12446249ce581addb73" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sDGwmn5ynV%2FZZWlP547A%2Bt22nW%2FxnEZ%2BDtPv%2FHOAKVoChzaI%2BCn0k2D7HYM%2Fi0gMMMgUeRgWL3MUKv4io1sc4Hswvh0YWE2E2WWYDQFXvb5BzeNAMgrNSpQZriWWwpXV6QaP5cM%3D"}],"group":"cf-nel","max_age":604800} x-goog-generation 1631650469931607 content-type application/javascript expires Fri, 17 Sep 2021 02:23:33 GMT cache-control public, max-age=7200, s-maxage=7200, must-revalidate x-goog-stored-content-length 153261 cf-ray 68fe7af70a8b409f-CDG cf-bgj minify
GET H2	200	debut_light.png pastelink.net/assets/images/	4 KB 4 KB	18ms 17ms	Image image/png	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/debut_light.png Requested by Host: pastelink.net URL: https://pastelink.net/assets/css/styles.css?q=8 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash c24ccee9a35eef9e74411eac871935bdff6bcb895cce80b754b66d3e4292a3ce Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :path /assets/images/debut_light.png pragma no-cache cookie PHPSESSID=8135vu1nr4tbljg7qrgp5e2abb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority pastelink.net referer https://pastelink.net/assets/css/styles.css?q=8 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/assets/css/styles.css?q=8 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT last-modified Thu, 27 May 2021 10:51:09 GMT server nginx etag "60af799d-10c8" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 4296
GET H2	200	sprites.png pastelink.net/assets/images/	4 KB 4 KB	18ms 17ms	Image image/png	178.79.155.87 LINODE-AP Linode
General Check archive.org Show headers Download Go to Show image Full URL https://pastelink.net/assets/images/sprites.png Requested by Host: pastelink.net URL: https://pastelink.net/assets/css/styles.css?q=8 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.155.87 London, United Kingdom, ASN63949 (LINODE-AP Linode, LLC, US), Reverse DNS li274-87.members.linode.com Software nginx / Resource Hash 736e1679b341206c435156f566998d48ad309ec22e277c12da51973bb42671c3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers :path /assets/images/sprites.png pragma no-cache cookie PHPSESSID=8135vu1nr4tbljg7qrgp5e2abb accept-encoding gzip, deflate, br accept-language de-DE,de;q=0.9 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 sec-fetch-mode no-cors accept image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 cache-control no-cache sec-fetch-dest image :authority pastelink.net referer https://pastelink.net/assets/css/styles.css?q=8 :scheme https sec-fetch-site same-origin :method GET Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/assets/css/styles.css?q=8 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:53 GMT last-modified Thu, 27 May 2021 10:51:10 GMT server nginx etag "60af799e-e11" strict-transport-security max-age=31536000; includeSubDomains content-type image/png accept-ranges bytes content-length 3601
GET H2	200	pxiEyp8kv8JHgFVrJJfecg.woff2 fonts.gstatic.com/s/poppins/v15/	8 KB 8 KB	70ms 21ms	Font font/woff2	142.250.186.131 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfecg.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f3.1e100.net Software sffe / Resource Hash 41e46faff74c6a77d581689ec35eb040f6c96d17f4d2c5b25dccd42ed498b01c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 13 Sep 2021 14:59:01 GMT x-content-type-options nosniff age 296152 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7900 x-xss-protection 0 last-modified Thu, 05 Nov 2020 22:02:01 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 13 Sep 2022 14:59:01 GMT
GET H2	200	JTURjIg1_i6t8kCHKm45_bZF3gnD_g.woff2 fonts.gstatic.com/s/montserrat/v18/	19 KB 19 KB	72ms 23ms	Font font/woff2	142.250.186.131 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/montserrat/v18/JTURjIg1_i6t8kCHKm45_bZF3gnD_g.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f3.1e100.net Software sffe / Resource Hash 61519deaa156f24ad28ae848179016c7cc741270cb7b30043c24bd30203bdaf3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Sun, 12 Sep 2021 14:39:52 GMT x-content-type-options nosniff age 383701 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19824 x-xss-protection 0 last-modified Tue, 10 Aug 2021 00:20:37 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Mon, 12 Sep 2022 14:39:52 GMT
GET H2	200	pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 fonts.gstatic.com/s/poppins/v15/	8 KB 8 KB	94ms 45ms	Font font/woff2	142.250.186.131 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlFQ.woff2 Requested by Host: fonts.googleapis.com URL: https://fonts.googleapis.com/css2?family=Montserrat:wght@600&family=Poppins:wght@400;500;700&display=swap Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f3.1e100.net Software sffe / Resource Hash d7ba57e3ccc2e3b2bdf8cc9e613194b802607682bf473293c2e3e29de82c9491 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://fonts.googleapis.com/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Mon, 13 Sep 2021 15:20:39 GMT x-content-type-options nosniff age 294854 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7776 x-xss-protection 0 last-modified Thu, 05 Nov 2020 22:01:55 GMT server sffe content-type font/woff2 access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes timing-allow-origin * expires Tue, 13 Sep 2022 15:20:39 GMT
GET H/1.1	200 OK	/ Show response pro.ip-api.com/csv/	6 B 154 B	57ms 9ms	XHR text/plain	51.77.64.70 OVH
General Check archive.org Show headers Download Go to Full URL https://pro.ip-api.com/csv/?key=ZxSSLwZtxrKxQbv&fields=countryCode,region Requested by Host: cdn.adligature.com URL: https://cdn.adligature.com/rules.js/advally-4.8.1.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 51.77.64.70 , Germany, ASN16276 (OVH, FR), Reverse DNS de-fra-1.pro.ip-api.com Software / Resource Hash 70eed4ae4f6f16678d18c5a3ffe7fa5ce9fc9595f16dcb1b8f730284d59d7a9d Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Fri, 17 Sep 2021 01:14:54 GMT Content-Length 6 Content-Type text/plain; charset=utf-8
GET H2	200	gpt.js Show response securepubads.g.doubleclick.net/tag/js/	73 KB 25 KB	85ms 32ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/tag/js/gpt.js Requested by Host: cdn.adligature.com URL: https://cdn.adligature.com/rules.js/advally-4.8.1.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software sffe / Resource Hash 5fb42eaf95f88a5c8b6d90056d0db785546f6821f851576b03bd2ad66d7cd606 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "989 / 487 of 1000 / last-modified: 1631830219" vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, max-age=900, stale-while-revalidate=3600 timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 24999 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Fri, 17 Sep 2021 01:14:54 GMT
GET H3	200	prebid-4.43.4.js Show response cdn.adligature.com/prebid/	444 KB 133 KB	34ms 33ms	Script application/javascript	172.67.202.177 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.adligature.com/prebid/prebid-4.43.4.js Requested by Host: cdn.adligature.com URL: https://cdn.adligature.com/rules.js/advally-4.8.1.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.202.177 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 4acafe4daf8d989eec849bdd8c025b2cda63bd1c3a91edaea56f948d04fd98a8 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers x-goog-hash crc32c=msxAWQ==, md5=z5RQdZzuWEiAct3OzqDEfQ== date Fri, 17 Sep 2021 01:14:53 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 199 cf-polished origSize=454478 x-guploader-uploadid ADPycdvLPugCKHdAGPZ4jZPvk2VAyFRzfrH9iGc_DclTBAVUM53YRlxyo_Ibo3-XhlPUYDD-yhOwhJbY4XqAAzDDzCg x-goog-storage-class MULTI_REGIONAL x-goog-metageneration 1 x-goog-stored-content-encoding identity alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400 last-modified Tue, 24 Aug 2021 12:17:06 GMT server cloudflare etag W/"cf9450759cee58488072ddcecea0c47d" expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ba6PpeTgK4QYtKiOXz6bFI3eEmnCfCtgZUZL9XEZ23cTJMUdpnE7hgBiuVatceB1yzn7RhMeW6Vjb8OzavpKPfQINgKgqmzjBVCm2hSe8TFIf8lpYkofqzLioAHmLOj1GPcKGbo%3D"}],"group":"cf-nel","max_age":604800} content-language en x-goog-generation 1629807426503184 content-type application/javascript expires Fri, 17 Sep 2021 01:21:34 GMT cache-control public, max-age=1800, s-maxage=600, must-revalidate x-goog-stored-content-length 454478 cf-ray 68fe7af75b2e0857-CDG cf-bgj minify
GET H2	200	recaptcha__de.js Show response www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/	343 KB 135 KB	75ms 24ms	Script text/javascript	142.250.185.131 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/wxAi4AKLXL2kBAvXqI4XLSWS/recaptcha__de.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.131 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f3.1e100.net Software sffe / Resource Hash 3d37b170affddaaa2a6489a82bab8df4e72c56a65b069991ea9084643d477d58 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://pastelink.net/ Origin https://pastelink.net Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 00:08:41 GMT content-encoding gzip x-content-type-options nosniff age 3973 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 137529 x-xss-protection 0 last-modified Mon, 30 Aug 2021 17:56:35 GMT server sffe vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="recaptcha" expires Sat, 17 Sep 2022 00:08:41 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	127 KB 50 KB	67ms 35ms	Script application/javascript	142.250.185.232 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.232 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f8.1e100.net Software Google Tag Manager / Resource Hash dacbfcfe448009c5c616bef67ba214f53e068a93f1753a6f320df8e1f6b848a4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:54 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 51100 x-xss-protection 0 expires Fri, 17 Sep 2021 01:14:54 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	48 KB 20 KB	68ms 20ms	Script text/javascript	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 11 Aug 2021 00:32:57 GMT server Golfe2 age 1374 date Fri, 17 Sep 2021 00:52:00 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 19747 expires Fri, 17 Sep 2021 02:52:00 GMT
GET H3	200	pubads_impl_2021091503.js Show response securepubads.g.doubleclick.net/gpt/	332 KB 116 KB	64ms 32ms	Script text/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software sffe / Resource Hash e152b757baeb786f86d661804414ffcf1ea9d533aadbe4d19642c25c2d9f9cf3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 118679 x-xss-protection 0 last-modified Wed, 15 Sep 2021 16:13:56 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control private, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Fri, 17 Sep 2021 01:14:54 GMT
GET H3	200	ppub_config Show response securepubads.g.doubleclick.net/pagead/	70 B 97 B	57ms 29ms	XHR application/json	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pastelink.net Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash 39c0b8be3e2bd4ecc61b4a789ac1e94d6a6812a15499181634db22e64fe7221c Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" access-control-allow-origin * cache-control private, max-age=3600, stale-while-revalidate=3600 cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 72 x-xss-protection 0 expires Fri, 17 Sep 2021 01:14:54 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	1 B 21 B	55ms 27ms	XHR text/plain	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1287328337&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3f1xe&ul=en-us&de=UTF-8&dt=The%20Best%20Guide%20To%20Why%20Rent%20to%20Own%20Homes%20are%20Trending%20in%20NYC%20and%20how%20to%20find%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=870145987&gjid=1891496735&cid=1886764100.1631841294&tid=UA-55088947-2&_gid=342673632.1631841294&_r=1&gtm=2wg9f055WHPWQ&z=428595555 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://pastelink.net/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 17 Sep 2021 01:14:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://pastelink.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	204	collect www.google-analytics.com/g/	0 17 B	43ms 28ms	Ping text/plain	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oe9f0&_p=1287328337&sr=1600x1200&ul=en-us&cid=1886764100.1631841294&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3f1xe&dt=The%20Best%20Guide%20To%20Why%20Rent%20to%20Own%20Homes%20are%20Trending%20in%20NYC%20and%20how%20to%20find%20-%20Pastelink.net&sid=1631841294&sct=1&seg=0&en=page_view&_fv=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://pastelink.net/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Fri, 17 Sep 2021 01:14:54 GMT server Golfe2 content-type text/plain access-control-allow-origin https://pastelink.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	27ms 27ms	XHR text/plain	142.250.186.142 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j93&aip=1&a=1287328337&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3f1xe&ul=en-us&de=UTF-8&dt=The%20Best%20Guide%20To%20Why%20Rent%20to%20Own%20Homes%20are%20Trending%20in%20NYC%20and%20how%20to%20find%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aEDAAEABAAAAAC~&jid=1451322603&gjid=1132854358&cid=1886764100.1631841294&tid=UA-197326395-9&_gid=342673632.1631841294&_r=1&_slc=1&z=4757949 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.142 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s07-in-f14.1e100.net Software Golfe2 / Resource Hash a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://pastelink.net/ Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Fri, 17 Sep 2021 01:14:54 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://pastelink.net cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
GET DATA	200 OK	truncated /	346 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash ebd635d843d43673dd737988e3383b01614cfca991785e481a47e7bd6b8aea17 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H2	200	integrator.js Show response adservice.google.de/adsid/	107 B 853 B	95ms 35ms	Script application/javascript	142.250.186.34 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.de/adsid/integrator.js?domain=pastelink.net Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.34 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s04-in-f2.1e100.net Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H2	200	integrator.js Show response adservice.google.com/adsid/	107 B 570 B	86ms 32ms	Script application/javascript	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://adservice.google.com/adsid/integrator.js?domain=pastelink.net Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info." cache-control private, no-cache, no-store cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 100 x-xss-protection 0
GET H3	200	ads Show response securepubads.g.doubleclick.net/gampad/	21 KB 8 KB	199ms 199ms	XHR text/plain	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2197646125256270&correlator=2169689735175711&output=ldjh&impl=fifs&eid=31062639%2C31062564%2C44748389&vrg=2021091503&ptt=17&sc=1&sfv=1-0-38&ecs=20210917&iu_parts=22405481091%2Cpastelink.net%2CBottom_adhesion_banner%2CTop_leaderboard%2CInline_banner%2CSidebar_MPU&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5&prev_iu_szs=728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C160x600&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1631841294&dt=1631841294259&dlt=1631841293736&idt=480&frm=20&biw=1600&bih=1200&oid=3&adxs=436%2C246%2C281%2C281%2C281%2C281%2C281%2C1119&adys=1104%2C307%2C865%2C1397%2C1974%2C2520%2C3040%2C355&adks=3402602959%2C2883060502%2C4220404771%2C4220404772%2C4220404773%2C4220404774%2C4220404775%2C2108190548&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fpastelink.net%2F3f1xe&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1%7C797x270%7C757x90%7C757x90%7C757x90%7C757x90%7C757x90%7C197x652&msz=728x-1%7C797x-1%7C728x-1%7C728x-1%7C728x-1%7C728x-1%7C728x-1%7C160x-1&ga_vid=1886764100.1631841294&ga_sid=1631841294&ga_hid=1287328337&ga_fc=false&ga_cid=342673632.1631841294&fws=516%2C4%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&btvi=0%7C0%7C0%7C1%7C2%7C3%7C4%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0. Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software cafe / Resource Hash 8783d5f5e7ad2192dde09d0f94bd3c53a4969ae82ecf8f21a542e38116519b15 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:54 GMT content-encoding br x-content-type-options nosniff google-mediationgroup-id -2,-2,-2,-2,-2,-2,-2 p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8483 x-xss-protection 0 google-lineitem-id -2,-2,-2,-2,-2,-1,-2,-2 pragma no-cache server cafe google-mediationtag-id -2 google-creative-id -2,-2,-2,-2,-2,-1,-2,-2 content-type text/plain; charset=UTF-8 access-control-allow-origin https://pastelink.net cache-control no-cache, must-revalidate access-control-allow-credentials true timing-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	container.html Show response 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5932	6 KB 4 KB	116ms 31ms	Document text/html	142.250.186.97 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.186.97 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f1.1e100.net Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com :scheme https :path /safeframe/1-0-38/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://pastelink.net/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Fri, 17 Sep 2021 01:14:54 GMT expires Sat, 17 Sep 2022 01:14:54 GMT cache-control public, immutable, max-age=31536000 last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	container.html Show response 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame BD2B	6 KB 3 KB	55ms 24ms	Document text/html	142.250.186.97 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.186.97 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s06-in-f1.1e100.net Software sffe / Resource Hash a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com :scheme https :path /safeframe/1-0-38/html/container.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://pastelink.net/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} timing-allow-origin * content-length 3108 date Fri, 17 Sep 2021 01:14:54 GMT expires Sat, 17 Sep 2022 01:14:54 GMT last-modified Tue, 02 Mar 2021 20:17:03 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, immutable, max-age=31536000 age 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H2	200	osd.js Show response www.googletagservices.com/activeview/js/current/	72 KB 27 KB	163ms 113ms	Script text/javascript	142.250.185.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/osd.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f2.1e100.net Software sffe / Resource Hash a97000b74006f16532e2d380cbed2e3dabd80ea9b85625fcb123d96cb9a0369a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 27627 x-xss-protection 0 server sffe etag "1631705383510867" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="active-view-scs-read-write-acl" expires Fri, 17 Sep 2021 01:14:54 GMT
GET H2	200	sodar Show response pagead2.googlesyndication.com/getconfig/	11 KB 9 KB	62ms 27ms	XHR application/json	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021091503&st=env Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software cafe / Resource Hash 6516f3986874b98d00ac42dce3acd1c5084a78e128f190e3bdb2ba6773bb10f7 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers timing-allow-origin * date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" access-control-allow-origin * cache-control private cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type application/json; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 8510 x-xss-protection 0
GET H3	200	adview securepubads.g.doubleclick.net/pagead/ Frame BD2B	0 0	34ms 33ms	Fetch text/html	142.250.185.226 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://securepubads.g.doubleclick.net/pagead/adview?ai=CTn-YDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTRAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-Sh2OF6ZmEShLii6f5uoluMWn4AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUygAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTkwNzA2Mjk4NDMxMjkzMTIY-t58&sigh=zH3Ww82ceI0 Requested by Host: pastelink.net URL: https://pastelink.net/3f1xe Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.226 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s53-in-f2.1e100.net Software / Resource Hash Request headers Accept-Language de-DE,de;q=0.9 Referer https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H/1.1	200	Cookie set ShowAd Show response brain.rvty.net/RTB/ Frame B6EA	2 KB 2 KB	52ms 13ms	Document text/html	89.163.211.233 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://brain.rvty.net/RTB/ShowAd?adHeight=90&adWidth=728&adFormat=4&adslotId=&siteId=97944753&bannerId=146072&e=3&p=YUPsDgAE4B4H_Yr7AA8xFOcp49Wztkmeh-6l0g&penc=&bp=38462&a=6143ec0e-0005-ee6a-08bb-c6b64501ab24&n=1&geo=662259&rawURL=https%3A%2F%2Fpastelink.net%2F3f1xe&rawReferrerURL=&uid=49781af3-6a8a-49e6-ab00-efb2bd3038c7&euid=&encn=N4IgXglgDiBcIDYAMBWATAThAGhAYwHsBXAOwBcAnATzhABEBRHEAQzLgEZcAbEgczgAOAHQJBAZnG48EMjXgAxCixIBrAGZEKZAAQsAtjoCyLCCWYBnMmwCmtABI2LFm+Z5s4KJMI4cEAdgBfIA&clickurl=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3D&gdpr=1&gdpr_consent= Requested by Host: 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com URL: https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.163.211.233 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS Software nginx/1.13.4 / Resource Hash f691d722ed8fd1f2a2a39cbc4ff2a3dc28a35bcd40ce0faf3791c723e4895fd9 Request headers Host brain.rvty.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/ Accept-Encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/ Response headers Server nginx/1.13.4 Date Fri, 17 Sep 2021 01:14:54 GMT Content-Type text/html;charset=UTF-8 Transfer-Encoding chunked Connection keep-alive Set-Cookie RTBUserId=49781af3-6a8a-49e6-ab00-efb2bd3038c7; path=/; SameSite=None; secure; Expires=Sat, 17 Sep 2022 03:14:54 CEST RTBUserId-Old=49781af3-6a8a-49e6-ab00-efb2bd3038c7; path=/; secure; Expires=Sat, 17 Sep 2022 03:14:54 CEST RTBUserId-Plain=49781af3-6a8a-49e6-ab00-efb2bd3038c7; path=/; Expires=Sat, 17 Sep 2022 03:14:54 CEST P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Content-Encoding gzip
GET H2	200	window_focus_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame BD2B	2 KB 1 KB	87ms 38ms	Script text/javascript	142.250.181.225 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js Requested by Host: 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com URL: https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.225 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f1.1e100.net Software cafe / Resource Hash b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 00:29:36 GMT content-encoding gzip x-content-type-options nosniff age 2718 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1339 x-xss-protection 0 server cafe etag 2275704724217174249 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Fri, 01 Oct 2021 00:29:36 GMT
GET H2	200	rx_lidar.js Show response www.googletagservices.com/activeview/js/current/ Frame BD2B	128 KB 39 KB	38ms 36ms	Script text/javascript	142.250.185.130 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914 Requested by Host: 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com URL: https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.185.130 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s50-in-f2.1e100.net Software sffe / Resource Hash fc8bce6b98f344ceb503d0c7c623ecf395808995efd843d616c3e7ab401a116f Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 39459 x-xss-protection 0 server sffe etag "1631705359914318" vary Accept-Encoding report-to {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="active-view-scs-read-write-acl" expires Fri, 17 Sep 2021 01:14:54 GMT
GET H2	200	qs_click_protection_fy2019.js Show response tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame BD2B	14 KB 6 KB	72ms 23ms	Script text/javascript	142.250.181.225 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js Requested by Host: 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com URL: https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.225 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f1.1e100.net Software cafe / Resource Hash 127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 00:29:36 GMT content-encoding gzip x-content-type-options nosniff age 2718 p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6211 x-xss-protection 0 server cafe etag 18326705275735229343 vary Accept-Encoding, Origin content-type text/javascript; charset=UTF-8 cache-control public, max-age=1209600 timing-allow-origin * expires Fri, 01 Oct 2021 00:29:36 GMT
GET H3	204	l www.google.com/ads/measurement/ Frame BD2B	0 0	79ms 30ms	Image text/html	142.250.185.68 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/measurement/l?ebcid=ALh7CaSPp22q1XOzQpgsh9NGcQzzXiz1xT1AcuebqNQAD2eBPA377nfqyqFhFvM0CHftX9keJZXj76pIePdBUh_j2JN-5KfDeA Requested by Host: 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com URL: https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.68 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f4.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H2	200	ext.js Show response tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame BD2B	22 KB 7 KB	68ms 20ms	Script text/javascript	142.250.181.225 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js Requested by Host: 595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com URL: https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.225 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f1.1e100.net Software sffe / Resource Hash 0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Wed, 15 Sep 2021 19:42:38 GMT content-encoding gzip x-content-type-options nosniff age 106336 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 7022 x-xss-protection 0 last-modified Tue, 02 Mar 2021 20:17:03 GMT server sffe vary Accept-Encoding report-to {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]} content-type text/javascript cache-control public, immutable, max-age=31536000 accept-ranges bytes timing-allow-origin * cross-origin-opener-policy-report-only same-origin; report-to="ads-gpt-scs" expires Thu, 15 Sep 2022 19:42:38 GMT
GET H2	200	sodar2.js Show response tpc.googlesyndication.com/sodar/	17 KB 7 KB	86ms 38ms	Script text/javascript	142.250.181.225 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2.js Requested by Host: securepubads.g.doubleclick.net URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091503.js?31062639 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.181.225 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f1.1e100.net Software sffe / Resource Hash a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:54 GMT content-encoding gzip x-content-type-options nosniff server sffe etag "1624308425655142" vary Accept-Encoding report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-type text/javascript cache-control private, max-age=3000 accept-ranges bytes alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 6467 x-xss-protection 0 cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" expires Fri, 17 Sep 2021 01:14:54 GMT
GET H/1.1	200 OK	ads_view.js Show response cdn.rvty.net/view/ Frame B6EA	3 KB 4 KB	64ms 11ms	Script application/javascript	89.163.211.242 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://cdn.rvty.net/view/ads_view.js Requested by Host: brain.rvty.net URL: https://brain.rvty.net/RTB/ShowAd?adHeight=90&adWidth=728&adFormat=4&adslotId=&siteId=97944753&bannerId=146072&e=3&p=YUPsDgAE4B4H_Yr7AA8xFOcp49Wztkmeh-6l0g&penc=&bp=38462&a=6143ec0e-0005-ee6a-08bb-c6b64501ab24&n=1&geo=662259&rawURL=https%3A%2F%2Fpastelink.net%2F3f1xe&rawReferrerURL=&uid=49781af3-6a8a-49e6-ab00-efb2bd3038c7&euid=&encn=N4IgXglgDiBcIDYAMBWATAThAGhAYwHsBXAOwBcAnATzhABEBRHEAQzLgEZcAbEgczgAOAHQJBAZnG48EMjXgAxCixIBrAGZEKZAAQsAtjoCyLCCWYBnMmwCmtABI2LFm+Z5s4KJMI4cEAdgBfIA&clickurl=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3D&gdpr=1&gdpr_consent= Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.163.211.242 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS Software nginx/1.13.4 / Resource Hash 00bb2f69ab06efff6555f6ccae10902e87bb6aea861e83de082a45a07e525054 Request headers Accept-Language de-DE,de;q=0.9 Referer https://brain.rvty.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 17 Sep 2021 01:14:54 GMT Last-Modified Fri, 20 Dec 2019 09:27:25 GMT Server nginx/1.13.4 ETag "5dfc93fd-d40" Content-Type application/javascript Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 3392
GET DATA	200 OK	truncated / Frame BD2B	212 B 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 93c0162c768aeda354a500649d465ea5527468e137787981d0852c08ee676de1 Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/png
GET H3	200	runner.html Show response tpc.googlesyndication.com/sodar/sodar2/224/ Frame CB4B	12 KB 5 KB	56ms 23ms	Document text/html	142.250.181.225 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.181.225 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s56-in-f1.1e100.net Software sffe / Resource Hash 4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers :method GET :authority tpc.googlesyndication.com :scheme https :path /sodar/sodar2/224/runner.html pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://pastelink.net/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ Response headers accept-ranges bytes vary Accept-Encoding content-encoding gzip content-type text/html cross-origin-resource-policy cross-origin cross-origin-opener-policy-report-only same-origin; report-to="adspam-signals-scs" report-to {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]} content-length 5029 date Thu, 16 Sep 2021 15:55:29 GMT expires Fri, 16 Sep 2022 15:55:29 GMT last-modified Wed, 02 Jun 2021 17:09:45 GMT x-content-type-options nosniff server sffe x-xss-protection 0 cache-control public, max-age=31536000 age 33565 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H3	200	aframe Show response www.google.com/recaptcha/api2/ Frame F869	783 B 535 B	33ms 33ms	Document text/html	142.250.185.68 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api2/aframe Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2.js Protocol H3 Security QUIC, , AES_128_GCM Server 142.250.185.68 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra16s48-in-f4.1e100.net Software GSE / Resource Hash c286fb985848769ff1719bc963270cddb887103d82b623b7b59680db86fd6c5f Security Headers Name Value Content-Security-Policy script-src 'report-sample' 'nonce-w0xwwjC03uOPgLDQNruF/g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers :method GET :authority www.google.com :scheme https :path /recaptcha/api2/aframe pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://pastelink.net/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ Response headers cross-origin-resource-policy cross-origin cross-origin-embedder-policy-report-only require-corp; report-to="recaptcha" report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} expires Fri, 17 Sep 2021 01:14:54 GMT date Fri, 17 Sep 2021 01:14:54 GMT cache-control private, max-age=300 content-type text/html; charset=utf-8 content-security-policy script-src 'report-sample' 'nonce-w0xwwjC03uOPgLDQNruF/g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 content-encoding gzip x-content-type-options nosniff x-xss-protection 1; mode=block content-length 513 server GSE alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
GET H/1.1	200 OK	8e93336o9ddx Show response ad.ad-srv.net/zone/ Frame B6EA	11 KB 4 KB	69ms 18ms	Script text/html	144.76.238.55 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://ad.ad-srv.net/zone/8e93336o9ddx?subid=&extVar[]=DOUBLEBORDER:1&extVar[]=ANIM_AFTER_30S:0&redirectClick=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3Dhttp%253A%252F%252Fbrain.rvty.net%252FRTB%252FClick%253Fx%253DEASY-X-COORDINATE%2526y%253DEASY-Y-COORDINATE%2526s%253D97944753%2526a%253D146072%2526t%253D1631841294616%2526l%253D662259%2526p%253D3%2526appid%253D%2526aa%253D6143ec0e-0005-ee6a-08bb-c6b64501ab24%2526gdpr%253D1%2526gdpr_consent%253D%2526dest%253D Requested by Host: brain.rvty.net URL: https://brain.rvty.net/RTB/ShowAd?adHeight=90&adWidth=728&adFormat=4&adslotId=&siteId=97944753&bannerId=146072&e=3&p=YUPsDgAE4B4H_Yr7AA8xFOcp49Wztkmeh-6l0g&penc=&bp=38462&a=6143ec0e-0005-ee6a-08bb-c6b64501ab24&n=1&geo=662259&rawURL=https%3A%2F%2Fpastelink.net%2F3f1xe&rawReferrerURL=&uid=49781af3-6a8a-49e6-ab00-efb2bd3038c7&euid=&encn=N4IgXglgDiBcIDYAMBWATAThAGhAYwHsBXAOwBcAnATzhABEBRHEAQzLgEZcAbEgczgAOAHQJBAZnG48EMjXgAxCixIBrAGZEKZAAQsAtjoCyLCCWYBnMmwCmtABI2LFm+Z5s4KJMI4cEAdgBfIA&clickurl=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3D&gdpr=1&gdpr_consent= Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 144.76.238.55 , Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.55.238.76.144.clients.your-server.de Software Apache / Resource Hash 4f72b42e5816c9f157f9ac289512cd05bd28ed35cc06a4d65875779d66f7fb84 Request headers Accept-Language de-DE,de;q=0.9 Referer https://brain.rvty.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 17 Sep 2021 01:14:54 GMT Content-Encoding gzip Server Apache Connection close Content-Length 3479 Vary Accept-Encoding Content-Type text/html; charset=UTF-8
GET H3	204	sodar pagead2.googlesyndication.com/pagead/ Frame F869	0 0	47ms 25ms	Image text/html	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021091503&jk=2197646125256270&rc= Protocol H3 Security QUIC, , AES_128_GCM Server 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://www.google.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers
GET H3	200	XcVhRkqPIT2L3eK0A2yH-xZ56-A5-6Pxm_m8s2he-Ag.js Show response pagead2.googlesyndication.com/bg/ Frame CB4B	35 KB 13 KB	14ms 14ms	Script text/javascript	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://pagead2.googlesyndication.com/bg/XcVhRkqPIT2L3eK0A2yH-xZ56-A5-6Pxm_m8s2he-Ag.js Requested by Host: tpc.googlesyndication.com URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html Protocol H3 Security QUIC, , AES_128_GCM Server 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software sffe / Resource Hash 5dc561464a8f213d8bdde2b4036c87fb1679ebe039fba3f19bf9bcb3685ef808 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://tpc.googlesyndication.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Thu, 16 Sep 2021 11:09:24 GMT content-encoding br x-content-type-options nosniff age 50730 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 13291 x-xss-protection 0 last-modified Mon, 13 Sep 2021 14:08:00 GMT server sffe vary Accept-Encoding report-to {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} content-type text/javascript cache-control public, max-age=31536000 accept-ranges bytes cross-origin-opener-policy-report-only same-origin; report-to="botguard-scs" expires Fri, 16 Sep 2022 11:09:24 GMT
GET H/1.1	200 OK	request.php Show response ad10.ad-srv.net/ Frame B6EA Redirect Chain https://ad10.ad-srv.net/request.php?zone=8e93336o9ddx&nw=14&renderingType=javascript&namespace=09096f845a&subid=&uid=20dba1b30a300019&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x9... https://ad10.ad-srv.net/request.php?zone=8e93336o9ddx&nw=14&renderingType=javascript&namespace=09096f845a&subid=&uid=20dba1b30a300019&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x9...	2 KB 1 KB	68ms 46ms	Script application/x-javascript	138.201.63.145 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://ad10.ad-srv.net/request.php?zone=8e93336o9ddx&nw=14&renderingType=javascript&namespace=09096f845a&subid=&uid=20dba1b30a300019&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=ANIM_AFTER_30S%3A0&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3Dhttp%253A%252F%252Fbrain.rvty.net%252FRTB%252FClick%253Fx%253DEASY-X-COORDINATE%2526y%253DEASY-Y-COORDINATE%2526s%253D97944753%2526a%253D146072%2526t%253D1631841294616%2526l%253D662259%2526p%253D3%2526appid%253D%2526aa%253D6143ec0e-0005-ee6a-08bb-c6b64501ab24%2526gdpr%253D1%2526gdpr_consent%253D%2526dest%253D&documentReferer=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2F&ancestorOrigins=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fpastelink.net&random=7705380064158&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1 Requested by Host: brain.rvty.net URL: https://brain.rvty.net/RTB/ShowAd?adHeight=90&adWidth=728&adFormat=4&adslotId=&siteId=97944753&bannerId=146072&e=3&p=YUPsDgAE4B4H_Yr7AA8xFOcp49Wztkmeh-6l0g&penc=&bp=38462&a=6143ec0e-0005-ee6a-08bb-c6b64501ab24&n=1&geo=662259&rawURL=https%3A%2F%2Fpastelink.net%2F3f1xe&rawReferrerURL=&uid=49781af3-6a8a-49e6-ab00-efb2bd3038c7&euid=&encn=N4IgXglgDiBcIDYAMBWATAThAGhAYwHsBXAOwBcAnATzhABEBRHEAQzLgEZcAbEgczgAOAHQJBAZnG48EMjXgAxCixIBrAGZEKZAAQsAtjoCyLCCWYBnMmwCmtABI2LFm+Z5s4KJMI4cEAdgBfIA&clickurl=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3D&gdpr=1&gdpr_consent= Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.201.63.145 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.145.63.201.138.clients.your-server.de Software Apache / Resource Hash dc9c2b0dfabe5f3387e63be70c2ca57e698020fc480ce4cb09d86bf7fdc8526f Request headers Accept-Language de-DE,de;q=0.9 Referer https://brain.rvty.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Pragma no-cache Date Fri, 17 Sep 2021 01:14:54 GMT Content-Encoding gzip Server Apache Vary Accept-Encoding P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control no-store, no-cache, must-revalidate, max-age=0 X-NEORY-SubId 96489300013399201324213011720010 Connection close Content-Type application/x-javascript; charset=utf-8 Content-Length 734 Expires Fri, 17 Sep 2021 02:14:54 +0200 Redirect headers Pragma no-cache Date Fri, 17 Sep 2021 01:14:54 GMT Server Apache P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Location request.php?zone=8e93336o9ddx&nw=14&renderingType=javascript&namespace=09096f845a&subid=&uid=20dba1b30a300019&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=ANIM_AFTER_30S%3A0&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3Dhttp%253A%252F%252Fbrain.rvty.net%252FRTB%252FClick%253Fx%253DEASY-X-COORDINATE%2526y%253DEASY-Y-COORDINATE%2526s%253D97944753%2526a%253D146072%2526t%253D1631841294616%2526l%253D662259%2526p%253D3%2526appid%253D%2526aa%253D6143ec0e-0005-ee6a-08bb-c6b64501ab24%2526gdpr%253D1%2526gdpr_consent%253D%2526dest%253D&documentReferer=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2F&ancestorOrigins=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fpastelink.net&random=7705380064158&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1 Cache-Control no-store, no-cache, must-revalidate, max-age=0 Connection close Content-Type text/html; charset=UTF-8 Content-Length 0 Expires Fri, 17 Sep 2021 02:14:54 +0200
GET H3	204	gen_204 pagead2.googlesyndication.com/pagead/	0 20 B	25ms 24ms	Image image/gif	216.58.212.162 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gpt_2021091503&jk=2197646125256270&bg=!bW6lbirNAAaUnz4elJ87ACkAdvg8WvdH6STgde4YuzJKMGl8jJKzz-7EUUrOFj6dISHKraAxDeSgPwIAAABLUgAAAAdoAQcKACitgp2YfjQicFltmoV3BvadI1znP-JEoPzO4i0zqecPhDCGt3bX6I-kmQJ8BMsl-Y6PAi1Dcwx8ij0hbiUhirt7HqBFMa4s-3u0OZFuV-pp2lIAGwIcVZ7upBIrZbLYzWuI6MTXDHjcb0rW2IZkiWuH2xaeUMDcaoOTpH6gB31jpwhbObLBpEKbSKXSaltil183udeKzb2ICHxN88ABU-oU46d9EEmhGB_X0YK_vBcFhwkXU4-Un5RIB_HzFivgKWNLiuODUGMjquECqp-muuKZd4UiaXkz5wGKobi-AW7a23RZdc38ZTYjxnC9aO44e9GkeGm1hX0iXTaD02UbUivg7H8TqRFPu2LnTnIM0j6wEXOTZivvaD2ElpWipUchapEiuA5xn6eR7sgA1dzn3EQDrPrMxrQZ8iyEhKbKcrx0xmHXoNllhKtDR6wngYpbiDjveSZh0MT1DzupCfX_VMdifWPvK5na4aZM7jBtbTazta1SsoqC-UvRDzbQ_d9gpbTeG1ERbI4fe2htK4j6Ry-Kh0piR6Qaf3UneaXZER7FKhhFas7dJXTQP6oywWyJSdPxeH2AX6wJ2duzcx1J8T_4D30vmUxRflfXFhIfCr7kYemJC8aWh8N9etw78Ewi1dAe3LY53MmpNxO8vadxS5vUI2lNcVZoDc7ijiFY2iqvNO9N0ZtfcgT48nVgUj1JyY1p1mdDcukSb5ELalaKXYbZjN4CpNlfp4Ed0NOA_Xz44zVPEjwIftW4Yu5LE1VYePXGfC4V7mWtvtP9VMrCEraVX73rmrj266Li6fPs0LVgvdZVOwojVIhVSZeRi6qrnV1ElDBbeeMIXUTqGzP8rJC2cR2gnQW3CSes1Oi082uJhqRrNWTrYiMduDqgloMbtaEv5B8KDtU- Protocol H3 Security QUIC, , AES_128_GCM Server 216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s01-in-f2.1e100.net Software cafe / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Accept-Language de-DE,de;q=0.9 Referer https://pastelink.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers pragma no-cache date Fri, 17 Sep 2021 01:14:54 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ztpv.php Show response www.conrad.de/ Frame 787B Redirect Chain https://www.awin1.com/cshow.php?s=2470174&v=11354&q=371933&r=278235&pv=1&pref1=96489300013399201324213011720010&gdpr=&gdpr_consent= https://www.zenaps.com/cshow.php?pvr=aab14a00-1754-11ec-a5f3-692d0d349c1f&v=11354&r=278235&q=371933&s=2470174&viewref=96489300013399201324213011720010&pv=1&gdpr=&gdpr_consent= https://www.conrad.de/ztpv.php?awc=11354_278235_1631841295_aab14a00-1754-11ec-a5f3-692d0d349c1f&insert=AW	0 708 B	81ms 37ms	Document text/html	104.18.127.5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://www.conrad.de/ztpv.php?awc=11354_278235_1631841295_aab14a00-1754-11ec-a5f3-692d0d349c1f&insert=AW Requested by Host: ad10.ad-srv.net URL: https://ad10.ad-srv.net/request.php?zone=8e93336o9ddx&nw=14&renderingType=javascript&namespace=09096f845a&subid=&uid=20dba1b30a300019&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=ANIM_AFTER_30S%3A0&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3Dhttp%253A%252F%252Fbrain.rvty.net%252FRTB%252FClick%253Fx%253DEASY-X-COORDINATE%2526y%253DEASY-Y-COORDINATE%2526s%253D97944753%2526a%253D146072%2526t%253D1631841294616%2526l%253D662259%2526p%253D3%2526appid%253D%2526aa%253D6143ec0e-0005-ee6a-08bb-c6b64501ab24%2526gdpr%253D1%2526gdpr_consent%253D%2526dest%253D&documentReferer=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2F&ancestorOrigins=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fpastelink.net&random=7705380064158&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.18.127.5 -, , ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=15552000 Request headers :method GET :authority www.conrad.de :scheme https :path /ztpv.php?awc=11354_278235_1631841295_aab14a00-1754-11ec-a5f3-692d0d349c1f&insert=AW pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 accept-language de-DE,de;q=0.9 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://brain.rvty.net/ accept-encoding gzip, deflate, br Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://brain.rvty.net/ Response headers date Fri, 17 Sep 2021 01:14:55 GMT content-type text/html; charset=UTF-8 server-timing intid;desc=f83199d72a5f3e21 intid;desc=0ac98e6a969c4986 cache-control no-cache expires -1 set-cookie HTLP_timestamp=1631841295; expires=Wed, 22-Sep-2021 01:14:55 GMT; Max-Age=432000; path=/; secure; SameSite=None CEAffHA=YD; expires=Wed, 22-Sep-2021 01:14:55 GMT; Max-Age=432000; path=/; secure; SameSite=None __cf_bm=2b2quWC6ZAx7Yl3CJVlpl6IMd5XQiHMUAt234FdXaao-1631841295-0-AWR/DgVwSf02vNGioE/izAgpta3xHfIAGP9m464ltWpGUishkWQ45uCtkVoqFx9SqAq145BSXJrGGaCADsOt2B4=; path=/; expires=Fri, 17-Sep-21 01:44:55 GMT; domain=.www.conrad.de; HttpOnly; Secure; SameSite=None p3p policyref="http://www.conrad.de/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR" age 0 strict-transport-security max-age=15552000 cf-cache-status DYNAMIC expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" server cloudflare cf-ray 68fe7afebdb7876a-DUS content-encoding br Redirect headers Location https://www.conrad.de/ztpv.php?awc=11354_278235_1631841295_aab14a00-1754-11ec-a5f3-692d0d349c1f&insert=AW Node Helix P3P policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV" Content-Length 0 Date Fri, 17 Sep 2021 01:14:55 GMT Connection keep-alive Set-Cookie awpv11354=278235|1631841295|aab14a00-1754-11ec-a5f3-692d0d349c1f;domain=.zenaps.com;path=/;expires=Monday, 20-Sep-2021 01:14:55 UTC;Secure;SameSite=None AWSESS=377133:2470174;domain=.zenaps.com;path=/;Secure;SameSite=None Strict-Transport-Security max-age=86400 Awin-Akamai-Rule-Set default
GET H/1.1	200 OK	request_content.php Show response ad10.ad-srv.net/ Frame 0A91	6 KB 2 KB	33ms 11ms	Document text/html	138.201.63.145 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://ad10.ad-srv.net/request_content.php?s=96489300013399201324213011720010&a=44ba778b Requested by Host: ad10.ad-srv.net URL: https://ad10.ad-srv.net/request.php?zone=8e93336o9ddx&nw=14&renderingType=javascript&namespace=09096f845a&subid=&uid=20dba1b30a300019&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=ANIM_AFTER_30S%3A0&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3Dhttp%253A%252F%252Fbrain.rvty.net%252FRTB%252FClick%253Fx%253DEASY-X-COORDINATE%2526y%253DEASY-Y-COORDINATE%2526s%253D97944753%2526a%253D146072%2526t%253D1631841294616%2526l%253D662259%2526p%253D3%2526appid%253D%2526aa%253D6143ec0e-0005-ee6a-08bb-c6b64501ab24%2526gdpr%253D1%2526gdpr_consent%253D%2526dest%253D&documentReferer=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2F&ancestorOrigins=https%3A%2F%2F595d86fb108ffe3dfd55b488bcfe5f2a.safeframe.googlesyndication.com%2Chttps%3A%2F%2Fpastelink.net&random=7705380064158&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.201.63.145 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.145.63.201.138.clients.your-server.de Software Apache / Resource Hash 71ad83f85ed67a8b40390950bd9bb2b954072eb48cecac8c0e2d23e92cf8a4bd Request headers Host ad10.ad-srv.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://brain.rvty.net/ Accept-Encoding gzip, deflate, br Cookie kdb0xdq3ls8m_uid=fd160846c3052f3e Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept-Language de-DE,de;q=0.9 Referer https://brain.rvty.net/ Response headers Date Fri, 17 Sep 2021 01:14:54 GMT Server Apache Cache-Control no-store, no-cache, must-revalidate, max-age=0 Expires Fri, 17 Sep 2021 02:14:54 +0200 Pragma no-cache P3P CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Vary Accept-Encoding Content-Encoding gzip Content-Length 2063 Connection close Content-Type text/html; charset=utf-8
GET H/1.1	200 OK	jquery-1.10.2.min.js Show response cdn.rvty.net/_files/js/ Frame C1D7	91 KB 91 KB	21ms 20ms	Script application/javascript	89.163.211.242 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://cdn.rvty.net/_files/js/jquery-1.10.2.min.js Requested by Host: cdn.rvty.net URL: https://cdn.rvty.net/view/ads_view.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.163.211.242 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS Software nginx/1.13.4 / Resource Hash 0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988 Request headers Accept-Language de-DE,de;q=0.9 Referer https://brain.rvty.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 17 Sep 2021 01:14:54 GMT Last-Modified Wed, 08 Jan 2020 08:13:37 GMT Server nginx/1.13.4 ETag "5e158f31-16bb3" Content-Type application/javascript Access-Control-Allow-Origin * Connection keep-alive Accept-Ranges bytes Content-Length 93107
GET H2	200	Bosch2021_728x90 asset.conrad.com/media10/isa/160267/c1/-/de/ Frame 0A91 Redirect Chain https://www.awin1.com/cshow.php?s=2470174&v=11354&q=371933&r=278235&pref1=96489300013399201324213011720010&gdpr=&gdpr_consent= https://www.zenaps.com/cshow.php?pvr=aab14a00-1754-11ec-a85c-692d033a3c28&v=11354&r=278235&q=371933&s=2470174&viewref=96489300013399201324213011720010&gdpr=&gdpr_consent= https://asset.conrad.com/media10/isa/160267/c1/-/de/Bosch2021_728x90?format=gif	45 KB 45 KB	162ms 30ms	Image image/gif	178.79.242.245 LLNW
General Check archive.org Show headers Download Go to Show image Full URL https://asset.conrad.com/media10/isa/160267/c1/-/de/Bosch2021_728x90?format=gif Requested by Host: ad10.ad-srv.net URL: https://ad10.ad-srv.net/request_content.php?s=96489300013399201324213011720010&a=44ba778b Protocol H2 Security TLS 1.3, , AES_256_GCM Server 178.79.242.245 , United States, ASN22822 (LLNW, US), Reverse DNS https-178-79-242-245.fra.llnw.net Software Cliplister GmbH / Resource Hash 19562c0912c944a5aa51d10fb6ec3329bb25efa2a0408d0834dbc27bf9548f68 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad10.ad-srv.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers date Fri, 17 Sep 2021 01:14:55 GMT last-modified Fri, 10 Sep 2021 07:01:04 GMT server Cliplister GmbH age 65094 etag "613b02b0-b218" strict-transport-security max-age=15768000 reporting eyJjb25zdW1lcmlkIjoxNjAyNjcsIm93bmVyaWQiOjE2MDI2NywidW5pcXVlaWQiOiIxNjAyNjdjd2xPeHNJTWlqaDhWXzhfcHhUMWt6QVQiLCJ1dWlkIjoiYTI5ZDRhOWE5ZjRkYzRjY2E5YWFjOTJjZWFjZTYwYWEwIiwiYXNzZXR0eXBlIjoicGljdHVyZSJ9 content-type image/gif access-control-allow-origin * cache-control max-age=172800 x-server c06 accept-ranges bytes content-length 45592 x-llid c1086bcf32b8f7be0cecf5ce81975a19 expires Sat, 18 Sep 2021 07:10:01 GMT Redirect headers Date Fri, 17 Sep 2021 01:14:55 GMT Strict-Transport-Security max-age=86400 P3P policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV" Location https://asset.conrad.com/media10/isa/160267/c1/-/de/Bosch2021_728x90?format=gif Awin-Akamai-Rule-Set default Node Helix Connection keep-alive Content-Length 0
GET H/1.1	200 OK	viewability Show response ad10.ad-srv.net/ Frame 0A91	0 150 B	34ms 12ms	Script text/html	138.201.63.145 HETZNER-AS
General Check archive.org Show headers Download Go to Full URL https://ad10.ad-srv.net/viewability?s=96489300013399201324213011720010&a=a8c6fb99&vb=m Requested by Host: ad10.ad-srv.net URL: https://ad10.ad-srv.net/request_content.php?s=96489300013399201324213011720010&a=44ba778b Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 138.201.63.145 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE), Reverse DNS static.145.63.201.138.clients.your-server.de Software Apache / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad10.ad-srv.net/request_content.php?s=96489300013399201324213011720010&a=44ba778b User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 17 Sep 2021 01:14:55 GMT Server Apache Connection close Content-Length 0 Content-Type text/html; charset=UTF-8
GET DATA	200 OK	truncated / Frame 0A91	43 B 0		Image image/gif
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers Accept-Language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Type image/gif
GET H/1.1	200 OK	addDoubleBorder.js Show response cdn.contentspread.net/oliro/tools/js/ Frame 0A91	851 B 1 KB	53ms 7ms	Script application/javascript	51.75.147.170 OVH
General Check archive.org Show headers Download Go to Full URL https://cdn.contentspread.net/oliro/tools/js/addDoubleBorder.js Requested by Host: ad10.ad-srv.net URL: https://ad10.ad-srv.net/request_content.php?s=96489300013399201324213011720010&a=44ba778b Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 51.75.147.170 , France, ASN16276 (OVH, FR), Reverse DNS ns3133977.ip-51-75-147.eu Software nginx / Resource Hash abaa484421865309a7781e540844f1b5260ed131080f8dd9f083d8f18beea107 Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad10.ad-srv.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 17 Sep 2021 01:14:55 GMT Last-Modified Sun, 01 Mar 2015 14:40:33 GMT Server nginx ETag "54f324e1-353" Content-Type application/javascript Connection close Accept-Ranges bytes Content-Length 851
GET H/1.1	200 OK	oba_icon.png cdn.contentspread.net/oliro/oba/ Frame 0A91	3 KB 3 KB	52ms 7ms	Image image/png	51.75.147.170 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.contentspread.net/oliro/oba/oba_icon.png Requested by Host: ad10.ad-srv.net URL: https://ad10.ad-srv.net/request_content.php?s=96489300013399201324213011720010&a=44ba778b Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 51.75.147.170 , France, ASN16276 (OVH, FR), Reverse DNS ns3133977.ip-51-75-147.eu Software nginx / Resource Hash 2fd4c3ae6afc2b4026d9f0b64b8ff1110ecfcf47b90bc988c06e844b3921cbf6 Request headers Accept-Language de-DE,de;q=0.9 Referer https://ad10.ad-srv.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Fri, 17 Sep 2021 01:14:55 GMT Last-Modified Fri, 05 Aug 2016 12:57:49 GMT Server nginx ETag "57a48d4d-c35" Content-Type image/png Connection close Accept-Ranges bytes Content-Length 3125
POST H/1.1	200	Visibility Show response brain.rvty.net/RTB/ Frame C1D7	0 119 B	10ms 10ms	XHR text/plain	89.163.211.233 MYLOC-AS IP Backb...
General Check archive.org Show headers Download Go to Full URL https://brain.rvty.net/RTB/Visibility Requested by Host: cdn.rvty.net URL: https://cdn.rvty.net/_files/js/jquery-1.10.2.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 89.163.211.233 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE), Reverse DNS Software nginx/1.13.4 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept */* Referer https://brain.rvty.net/RTB/ShowAd?adHeight=90&adWidth=728&adFormat=4&adslotId=&siteId=97944753&bannerId=146072&e=3&p=YUPsDgAE4B4H_Yr7AA8xFOcp49Wztkmeh-6l0g&penc=&bp=38462&a=6143ec0e-0005-ee6a-08bb-c6b64501ab24&n=1&geo=662259&rawURL=https%3A%2F%2Fpastelink.net%2F3f1xe&rawReferrerURL=&uid=49781af3-6a8a-49e6-ab00-efb2bd3038c7&euid=&encn=N4IgXglgDiBcIDYAMBWATAThAGhAYwHsBXAOwBcAnATzhABEBRHEAQzLgEZcAbEgczgAOAHQJBAZnG48EMjXgAxCixIBrAGZEKZAAQsAtjoCyLCCWYBnMmwCmtABI2LFm+Z5s4KJMI4cEAdgBfIA&clickurl=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCfZJjDuxDYZ7AE_uV9u8PlOK8uAXm_qP3XO6LrIhfwI23ARABIABgleKQgqAHggEXY2EtcHViLTkwNzA2Mjk4NDMxMjkzMTLIAQmpAhXqtYYXvrM-4AIAqAMBqgTUAU_Q24myD1JV6YQVUx81mCupNqnzU_4SDQFFdONfYRjesBMFeNJ8eDhiLqeArf8WSMpaNDXlBhf-ARg6vI3-0cf4lsBSaNcsV_9D0fdJWMsAM5g9fhsbBT5sRjC2TC_VidMXH7DydIz39iot1gylXoMm6afe98wByGTonevs6kpJxuWdhx5qu1Ij6NNIpjKvuIe_c-bj2vQ-4J9pSs5sQGpRzMlh2hhq_OFWwvBR_mqWQWPnSD3rZ2idIULnycF-CB-DhSyH1xC3TGcUOMSqTr-zVh594AQBgAac9qH43vLlzPEBoAYhqAemvhuoB_DZG6gH8tkbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAcIiOGAEBAB8ggbYWR4LXN1YnN5bi0yNzI3MDk4MTUwODU3MzUy-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_2sh2qw50tpV5jCKHxo11iDc6_shA%26client%3Dca-pub-9070629843129312%26adurl%3D&gdpr=1&gdpr_consent= X-Requested-With XMLHttpRequest Accept-Language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Fri, 17 Sep 2021 01:14:54 GMT Server nginx/1.13.4 Connection keep-alive Content-Length 0