www.onmsft.com Open in urlscan Pro
104.26.15.66 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.onmsft.com/
Effective URL:
https://www.onmsft.com/
Submission: On November 18 via api (November 18th 2021, 3:51:17 pm UTC) from US — Scanned from DE

Summary HTTP 312 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 66 IPs in 8 countries across 52 domains to perform 312 HTTP transactions. The main IP is 104.26.15.66, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.onmsft.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 21st 2021. Valid for: a year.

This is the only time www.onmsft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 60	104.26.15.66 104.26.15.66	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 7	2.16.186.144 2.16.186.144	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2600:9000:211... 2600:9000:211e:f800:14:2602:6e80:93a1	16509 (AMAZON-02) (AMAZON-02)
1 21	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
2	104.111.225.185 104.111.225.185	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2620:1ec:42::132 2620:1ec:42::132	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
1	2606:4700::68... 2606:4700::6810:5f41	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	13.32.21.201 13.32.21.201	16509 (AMAZON-02) (AMAZON-02)
14	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
21	2600:9000:206... 2600:9000:206f:4c00:12:4abd:d340:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2600:9000:205... 2600:9000:2057:5a00:1a:1459:5cc0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2.18.235.40 2.18.235.40	16625 (AKAMAI-AS) (AKAMAI-AS)
5	35.186.219.42 35.186.219.42	15169 (GOOGLE) (GOOGLE)
1	35.201.98.64 35.201.98.64	15169 (GOOGLE) (GOOGLE)
1	2620:1ec:27::... 2620:1ec:27::cafe:1503	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a00:1450:400... 2a00:1450:4001:811::200a	15169 (GOOGLE) (GOOGLE)
1	46.105.202.126 46.105.202.126	16276 (OVH) (OVH)
1	2a00:1450:400... 2a00:1450:4001:829::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
13	2a00:1450:400... 2a00:1450:4001:828::200e	15169 (GOOGLE) (GOOGLE)
1 3	13.35.253.75 13.35.253.75	16509 (AMAZON-02) (AMAZON-02)
1 5	99.80.67.55 99.80.67.55	16509 (AMAZON-02) (AMAZON-02)
4	2600:9000:214... 2600:9000:214f:5a00:2:42d9:3100:93a1	16509 (AMAZON-02) (AMAZON-02)
2	34.228.209.86 34.228.209.86	14618 (AMAZON-AES) (AMAZON-AES)
2	2606:2800:234... 2606:2800:234:59:254c:406:2366:268c	15133 (EDGECAST) (EDGECAST)
1	18.171.9.184 18.171.9.184	16509 (AMAZON-02) (AMAZON-02)
5	2600:9000:211... 2600:9000:211e:1400:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	35.190.76.239 35.190.76.239	15169 (GOOGLE) (GOOGLE)
3	2600:9000:205... 2600:9000:2057:e600:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
5	34.254.9.67 34.254.9.67	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:400c:c07::9a	15169 (GOOGLE) (GOOGLE)
4	52.182.214.99 52.182.214.99	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.244.42.72 104.244.42.72	13414 (TWITTER) (TWITTER)
2	52.215.85.116 52.215.85.116	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:803::2006	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::2016	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
1	143.204.215.5 143.204.215.5	16509 (AMAZON-02) (AMAZON-02)
1	34.228.50.94 34.228.50.94	14618 (AMAZON-AES) (AMAZON-AES)
1	104.111.228.137 104.111.228.137	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2600:9000:205... 2600:9000:2057:d000:1d:667e:2a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	151.101.66.133 151.101.66.133	54113 (FASTLY) (FASTLY)
12	2a00:1450:400... 2a00:1450:4001:80f::2001	15169 (GOOGLE) (GOOGLE)
1	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
2 5	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	2602:803:c004... 2602:803:c004:200::140	26667 (RUBICONPR...) (RUBICONPROJECT)
1 3	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
3 5	185.33.221.52 185.33.221.52	29990 (ASN-APPNEX) (ASN-APPNEX)
2	2a00:1450:400... 2a00:1450:4001:82a::2001	15169 (GOOGLE) (GOOGLE)
3	34.95.92.134 34.95.92.134	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
4 9	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
18	2a00:1450:400... 2a00:1450:4001:801::2006	15169 (GOOGLE) (GOOGLE)
36	50.16.140.108 50.16.140.108	14618 (AMAZON-AES) (AMAZON-AES)
3	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	2606:4700::68... 2606:4700::6812:c05	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1 1	2a00:1288:110... 2a00:1288:110:c305::8000	34010 (YAHOO-IRD) (YAHOO-IRD)
2 2	37.157.2.239 37.157.2.239	198622 (ADFORM) (ADFORM)
1 1	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
312	66

60 104.26.15.66 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

www.onmsft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.16.186.144 (Frankfurt am Main, Germany) 1 redirects

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-144.deploy.static.akamaitechnologies.com

cdn.nsstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
g.pcmag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ns.zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.static.zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:211e:f800:14:2602:6e80:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.intergi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.225.185 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-225-185.deploy.static.akamaitechnologies.com

static2.sharepointonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:42::132 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

teams.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5f41 (United States)

ASN13335 (CLOUDFLARENET, US)

static.cloudflareinsights.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.21.201 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-21-201.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2600:9000:206f:4c00:12:4abd:d340:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.intergient.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2057:5a00:1a:1459:5cc0:93a1 (United States)

ASN16509 (AMAZON-02, US)

config.playwire.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.18.235.40 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-40.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 35.186.219.42 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 42.219.186.35.bc.googleusercontent.com

chickensstation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.201.98.64 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 64.98.201.35.bc.googleusercontent.com

dapperfloor.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:27::cafe:1503 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:811::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.202.126 (France)

ASN16276 (OVH, FR)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:828::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.35.253.75 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-35-253-75.fra6.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 99.80.67.55 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-99-80-67-55.eu-west-1.compute.amazonaws.com

secure-us.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:214f:5a00:2:42d9:3100:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.228.209.86 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-228-209-86.compute-1.amazonaws.com

gurgle.zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)

platform.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.171.9.184 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-171-9-184.eu-west-2.compute.amazonaws.com

mb.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2600:9000:211e:1400:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.76.239 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 239.76.190.35.bc.googleusercontent.com

admiral.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2600:9000:2057:e600:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.254.9.67 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-9-67.eu-west-1.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c07::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.182.214.99 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

g.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.72 (United States)

ASN13414 (TWITTER, US)

syndication.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.215.85.116 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-85-116.eu-west-1.compute.amazonaws.com

zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.215.5 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-5.fra53.r.cloudfront.net

bee.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.228.50.94 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-228-50-94.compute-1.amazonaws.com

jogger.zdbb.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.228.137 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-137.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2057:d000:1d:667e:2a40:93a1 (United States)

ASN16509 (AMAZON-02, US)

ih8i01rvpi9ilkttxeflyi70hutup1637250662.nuid.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.66.133 (United States)

ASN54113 (FASTLY, US)

cdn.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:80f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2.18.234.21 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2602:803:c004:200::140 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

ziffdavis-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
eu-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.33.221.52 (Amsterdam, Netherlands) 3 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.95.92.134 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 134.92.95.34.bc.googleusercontent.com

my.getadmiral.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 142.250.185.162 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2a00:1450:4001:801::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

36 50.16.140.108 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-16-140-108.compute-1.amazonaws.com

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ade.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:c05 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1288:110:c305::8000 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.2.239 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.253.211 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	onmsft.com 2 redirects www.onmsft.com	457 KB
46	adsafeprotected.com static.adsafeprotected.com pixel.adsafeprotected.com dt.adsafeprotected.com	200 KB
32	doubleclick.net 5 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net stats.g.doubleclick.net static.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net	205 KB
30	googlesyndication.com pagead2.googlesyndication.com tpc.googlesyndication.com 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com ade.googlesyndication.com	277 KB
21	intergient.com cdn.intergient.com	646 KB
18	2mdn.net s0.2mdn.net	203 KB
11	imrworldwide.com 1 redirects secure-us.imrworldwide.com cdn-gl.imrworldwide.com bee.imrworldwide.com ih8i01rvpi9ilkttxeflyi70hutup1637250662.nuid.imrworldwide.com	75 KB
10	zdbb.net 1 redirects ns.zdbb.net cdn.static.zdbb.net gurgle.zdbb.net zdbb.net jogger.zdbb.net	29 KB
9	youtube.com www.youtube.com	704 KB
7	clarity.ms 1 redirects www.clarity.ms g.clarity.ms c.clarity.ms	25 KB
5	adnxs.com 3 redirects ib.adnxs.com	5 KB
5	casalemedia.com 2 redirects as-sec.casalemedia.com dsum-sec.casalemedia.com	4 KB
5	chickensstation.com chickensstation.com	134 KB
4	openx.net 2 redirects ziffdavis-d.openx.net rtb.openx.net eu-u.openx.net us-u.openx.net	1 KB
4	google.com adservice.google.com www.google.com	15 KB
4	google-analytics.com www.google-analytics.com	20 KB
4	gstatic.com fonts.gstatic.com www.gstatic.com	77 KB
4	moatads.com z.moatads.com mb.moatads.com	226 KB
3	googletagservices.com www.googletagservices.com	110 KB
3	getadmiral.com my.getadmiral.com	16 KB
3	disquscdn.com c.disquscdn.com	4 KB
3	twitter.com platform.twitter.com syndication.twitter.com	133 KB
3	scorecardresearch.com 1 redirects sb.scorecardresearch.com	2 KB
3	playwire.com config.playwire.com	10 KB
3	amazon-adsystem.com c.amazon-adsystem.com	4 KB
3	intergi.com cdn.intergi.com	162 KB
2	adform.net 2 redirects c1.adform.net	1 KB
2	tribalfusion.com 1 redirects a.tribalfusion.com s.tribalfusion.com	1 KB
2	google.de adservice.google.de	957 B
2	wp.com stats.wp.com pixel.wp.com	3 KB
2	sharepointonline.com static2.sharepointonline.com	214 KB
1	yahoo.com 1 redirects pr-bh.ybp.yahoo.com	936 B
1	adsrvr.org match.adsrvr.org	265 B
1	cloudflare.com cdnjs.cloudflare.com	34 KB
1	rubiconproject.com fastlane.rubiconproject.com	3 KB
1	pubmatic.com hbopenbid.pubmatic.com	115 B
1	bluekai.com stags.bluekai.com	337 B
1	krxd.net cdn.krxd.net	394 B
1	bkrtx.com tags.bkrtx.com	16 KB
1	ytimg.com i.ytimg.com	40 KB
1	ggpht.com yt3.ggpht.com	3 KB
1	bing.com 1 redirects c.bing.com	551 B
1	googleadservices.com partner.googleadservices.com	405 B
1	consensu.org admiral.mgr.consensu.org	2 KB
1	googletagmanager.com www.googletagmanager.com	39 KB
1	id5-sync.com cdn.id5-sync.com	10 KB
1	googleapis.com fonts.googleapis.com	1 KB
1	dapperfloor.com dapperfloor.com	6 KB
1	pcmag.com g.pcmag.com	265 B
1	cloudflareinsights.com static.cloudflareinsights.com	5 KB
1	microsoft.com teams.microsoft.com	15 KB
1	nsstatic.com cdn.nsstatic.com	145 KB
312	52

	Domain	Requested by
60	www.onmsft.com	2 redirects www.onmsft.com static.cloudflareinsights.com
36	dt.adsafeprotected.com
21	cdn.intergient.com	cdn.intergi.com cdn.intergient.com
18	s0.2mdn.net	www.onmsft.com s0.2mdn.net 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
15	pagead2.googlesyndication.com	www.onmsft.com pagead2.googlesyndication.com tpc.googlesyndication.com 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com googleads.g.doubleclick.net s0.2mdn.net www.googletagservices.com
13	securepubads.g.doubleclick.net	cdn.nsstatic.com securepubads.g.doubleclick.net www.onmsft.com www.googletagservices.com
12	tpc.googlesyndication.com	pagead2.googlesyndication.com tpc.googlesyndication.com www.onmsft.com securepubads.g.doubleclick.net 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com s0.2mdn.net
9	cm.g.doubleclick.net	4 redirects googleads.g.doubleclick.net 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
9	www.youtube.com	www.onmsft.com www.youtube.com
6	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com www.youtube.com 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com www.onmsft.com
5	ib.adnxs.com	3 redirects cdn.nsstatic.com googleads.g.doubleclick.net
5	pixel.adsafeprotected.com	cdn.nsstatic.com www.onmsft.com
5	static.adsafeprotected.com	www.onmsft.com pixel.adsafeprotected.com
5	secure-us.imrworldwide.com	1 redirects secure-us.imrworldwide.com www.onmsft.com
5	chickensstation.com	www.onmsft.com chickensstation.com
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	g.clarity.ms	www.clarity.ms g.clarity.ms
4	cdn-gl.imrworldwide.com	www.onmsft.com secure-us.imrworldwide.com cdn-gl.imrworldwide.com
4	cdn.static.zdbb.net	1 redirects www.onmsft.com cdn.static.zdbb.net
4	www.google-analytics.com	cdn.nsstatic.com www.google-analytics.com
3	www.googletagservices.com	securepubads.g.doubleclick.net 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
3	my.getadmiral.com	chickensstation.com my.getadmiral.com
3	c.disquscdn.com	www.onmsft.com
3	sb.scorecardresearch.com	1 redirects cdn.nsstatic.com www.onmsft.com
3	z.moatads.com	cdn.intergi.com
3	config.playwire.com	cdn.intergi.com
3	c.amazon-adsystem.com	cdn.nsstatic.com
3	cdn.intergi.com	www.onmsft.com securepubads.g.doubleclick.net
2	c1.adform.net	2 redirects
2	googleads4.g.doubleclick.net	www.onmsft.com
2	90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
2	www.gstatic.com	www.youtube.com www.gstatic.com
2	www.google.com	www.youtube.com tpc.googlesyndication.com
2	zdbb.net	www.onmsft.com cdn.static.zdbb.net
2	c.clarity.ms	1 redirects www.onmsft.com
2	adservice.google.com	pagead2.googlesyndication.com securepubads.g.doubleclick.net
2	adservice.google.de	pagead2.googlesyndication.com securepubads.g.doubleclick.net
2	platform.twitter.com	www.onmsft.com platform.twitter.com
2	gurgle.zdbb.net	www.onmsft.com cdn.static.zdbb.net
2	fonts.gstatic.com	fonts.googleapis.com www.youtube.com
2	static2.sharepointonline.com	www.onmsft.com static2.sharepointonline.com
1	ade.googlesyndication.com
1	us-u.openx.net
1	eu-u.openx.net	1 redirects
1	rtb.openx.net	1 redirects
1	pr-bh.ybp.yahoo.com	1 redirects
1	match.adsrvr.org	90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
1	s.tribalfusion.com
1	a.tribalfusion.com	1 redirects
1	cdnjs.cloudflare.com	s0.2mdn.net
1	ziffdavis-d.openx.net	cdn.nsstatic.com
1	fastlane.rubiconproject.com	cdn.nsstatic.com
1	hbopenbid.pubmatic.com	cdn.nsstatic.com
1	as-sec.casalemedia.com	cdn.nsstatic.com
1	stags.bluekai.com	tags.bkrtx.com
1	cdn.krxd.net	cdn.static.zdbb.net
1	ih8i01rvpi9ilkttxeflyi70hutup1637250662.nuid.imrworldwide.com
1	tags.bkrtx.com	cdn.static.zdbb.net
1	jogger.zdbb.net	cdn.static.zdbb.net
1	bee.imrworldwide.com	secure-us.imrworldwide.com
1	i.ytimg.com	www.youtube.com
1	yt3.ggpht.com	www.youtube.com
1	static.doubleclick.net	www.youtube.com
1	syndication.twitter.com	platform.twitter.com
1	c.bing.com	1 redirects
1	stats.g.doubleclick.net	www.google-analytics.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	admiral.mgr.consensu.org	chickensstation.com
1	mb.moatads.com	z.moatads.com
1	pixel.wp.com	www.onmsft.com
1	www.googletagmanager.com	www.onmsft.com
1	cdn.id5-sync.com	www.onmsft.com
1	fonts.googleapis.com	www.onmsft.com
1	www.clarity.ms	www.onmsft.com
1	dapperfloor.com	www.onmsft.com
1	ns.zdbb.net	cdn.nsstatic.com
1	g.pcmag.com	cdn.nsstatic.com
1	static.cloudflareinsights.com	www.onmsft.com
1	stats.wp.com	www.onmsft.com
1	teams.microsoft.com	www.onmsft.com
1	cdn.nsstatic.com	www.onmsft.com
312	81

This site contains links to these domains. Also see Links.

Domain
www.facebook.com
twitter.com
www.youtube.com
www.pinterest.com
disqus.com
ravenousravendesign.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-21` - `2022-07-20`	a year	crt.sh
www.ziffdavis.com COMODO RSA Organization Validation Secure Server CA	`2021-03-03` - `2022-02-25`	a year	crt.sh
cdn.intergi.com Amazon	`2021-02-03` - `2022-03-04`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
*.sharepointonline.com Microsoft RSA TLS CA 01	`2021-07-08` - `2022-07-08`	a year	crt.sh
teams.microsoft.com Microsoft RSA TLS CA 02	`2021-10-07` - `2022-10-07`	a year	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
c.amazon-adsystem.com Amazon	`2021-07-06` - `2022-06-27`	a year	crt.sh
cdn.intergient.com Amazon	`2021-02-03` - `2022-03-04`	a year	crt.sh
*.playwire.com Amazon	`2021-04-12` - `2022-05-11`	a year	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2021-01-21` - `2022-01-25`	a year	crt.sh
chickensstation.com R3	`2021-10-21` - `2022-01-19`	3 months	crt.sh
dapperfloor.com R3	`2021-11-12` - `2022-02-10`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2021-06-01` - `2022-06-01`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
cdn.id5-sync.com R3	`2021-09-15` - `2021-12-14`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.scorecardresearch.com Amazon	`2021-02-28` - `2022-03-29`	a year	crt.sh
*.zdbb.net Amazon	`2021-05-05` - `2022-06-03`	a year	crt.sh
*.twimg.com DigiCert TLS RSA SHA256 2020 CA1	`2021-10-20` - `2022-10-19`	a year	crt.sh
*.moatads.com DigiCert TLS RSA SHA256 2020 CA1	`2021-05-25` - `2022-06-25`	a year	crt.sh
static.adsafeprotected.com Amazon	`2021-09-05` - `2022-10-04`	a year	crt.sh
admiral.mgr.consensu.org GTS CA 1D4	`2021-10-23` - `2022-01-21`	3 months	crt.sh
a.disquscdn.com Amazon	`2021-10-31` - `2022-11-28`	a year	crt.sh
*.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-10-18` - `2022-01-10`	3 months	crt.sh
fw.adsafeprotected.com Amazon	`2021-08-11` - `2022-09-09`	a year	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh
syndication.twitter.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-05` - `2022-02-04`	a year	crt.sh
zdbb.net Amazon	`2021-02-25` - `2022-03-26`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
*.imrworldwide.com DigiCert TLS RSA SHA256 2020 CA1	`2021-01-28` - `2022-02-01`	a year	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2021-04-02` - `2022-04-07`	a year	crt.sh
*.nuid.imrworldwide.com Amazon	`2021-06-11` - `2022-07-10`	a year	crt.sh
cdn.krxd.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2021-02-08` - `2022-02-07`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2021-11-01` - `2022-01-24`	3 months	crt.sh
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2021-10-18` - `2022-04-26`	6 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2021-08-04` - `2022-09-04`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
my.getadmiral.com Sectigo RSA Extended Validation Secure Server CA	`2020-07-15` - `2022-07-15`	2 years	crt.sh
dt.adsafeprotected.com Amazon	`2021-04-22` - `2022-05-21`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh

This page contains 30 frames:

Primary Page: https://www.onmsft.com/
Frame ID: 1522CE3DDEFCB585BE07B12F448942D0
Requests: 187 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html
Frame ID: AC3D6F7BC7DD6A13029A1C3F41B0FDEC
Requests: 1 HTTP requests in this frame

Frame: https://admiral.mgr.consensu.org/portal.html
Frame ID: 584FACE76F9F98BB1637085449B29360
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
Frame ID: B4E64DEB3E53530B45C536433AD79682
Requests: 18 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1197011367764122&output=html&adk=1812271804&adf=3025194257&lmt=1637249397&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.onmsft.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637250661550&bpp=3&bdt=645&idt=289&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7560448573203&frm=20&pv=2&ga_vid=1565518977.1637250662&ga_sid=1637250662&ga_hid=678711843&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740&oid=2&pvsid=370371658239117&pem=687&tmod=1454011181&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=308
Frame ID: B4714A5196816C699CA9644EFB08B5A4
Requests: 1 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.a53eecb4584348a2ad32ec2ae21f6eae.html?origin=https%3A%2F%2Fwww.onmsft.com
Frame ID: 86D61FA557EE938391DBB1F799386EBE
Requests: 2 HTTP requests in this frame

Frame: https://secure-us.imrworldwide.com/storageframe.html
Frame ID: 5813F3C1B72670AA2EF7301B3D2494B6
Requests: 1 HTTP requests in this frame

Frame: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Frame ID: 3AEBCA047B98679ED0A8E95808279264
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html
Frame ID: 153DFFF9BBC363F453DB8B7EEA3240B3
Requests: 2 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 059E25B3DCC1662CE5DD83C3616CDF42
Requests: 2 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Donmsft.com&phint=referer%3Dhttps%3A%2F%2Fwww.onmsft.com%2F&phint=bbseg%3D900099&phint=bbseg%3D900102&phint=bbseg%3D900103&phint=bbseg%3D900109&phint=bbseg%3D900110&phint=bbseg%3D900111&phint=bbseg%3D900113&phint=bbseg%3D900114&phint=bbseg%3D900115&phint=bbseg%3D900136&phint=bbseg%3D900151&phint=bbseg%3D900152&phint=bbseg%3D900155&phint=bbseg%3D900156&phint=bbseg%3D900157&phint=bbseg%3D900160&phint=bbseg%3D900162&phint=bbseg%3D900163&phint=bbseg%3D900165&phint=bbseg%3D900169&phint=bbseg%3D900171&phint=bbseg%3D900172&phint=bbseg%3D900178&phint=bbseg%3D900182&phint=bbseg%3D900190&phint=bbseg%3D900191&phint=bbseg%3D900192&phint=bbseg%3D900193&phint=bbseg%3D900195&phint=bbseg%3D900196&phint=bbseg%3D900200&phint=bbseg%3D900207&phint=bbseg%3D900220&phint=bbseg%3D7293&phint=bbseg%3D900241&phint=bbseg%3D900243&phint=bbseg%3D900247&phint=bbseg%3D900248&phint=bbseg%3D900249&phint=bbseg%3D900250&phint=bbseg%3D900251&phint=bbseg%3D900252&phint=bbseg%3D900253&phint=bbseg%3D900254&phint=bbseg%3D900255&phint=bbseg%3D900263&phint=bbseg%3D900272&phint=bbseg%3D900282&phint=bbseg%3D900286&phint=bbseg%3D900294&phint=bbseg%3D900296&phint=bbseg%3D900298&phint=bbseg%3D900307&phint=bbseg%3D900309&phint=bbseg%3D900313&phint=bbseg%3D900330&phint=bbseg%3D900331&phint=bbseg%3D900332&phint=bbseg%3D6894&phint=bbseg%3D1100533&phint=bbseg%3D1100042&phint=bbseg%3D6929&phint=bbseg%3D6947&phint=bbseg%3D6953&phint=bbseg%3D1100077&phint=bbseg%3D1100095&phint=bbseg%3D1100101&phint=bbseg%3D900002&phint=bbseg%3D900003&phint=bbseg%3D900009&phint=bbseg%3D900017&phint=bbseg%3D900033&phint=bbseg%3D900041&phint=bbseg%3D900042&phint=bbseg%3D900049&phint=bbseg%3D900058&phint=bbseg%3D900059&phint=bbseg%3D900060&phint=bbseg%3D900061&phint=bbseg%3D900067&phint=bbseg%3D900068&phint=bbseg%3D900071&phint=bbseg%3D900081&phint=bbseg%3D900082&phint=bbseg%3D900085&phint=bbseg%3D900086&phint=bbseg%3D900092&phint=__bk_t%3DOnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fwww.onmsft.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=19424937
Frame ID: BF73839142AB1070C758B46090BBE198
Requests: 1 HTTP requests in this frame

Frame: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 1E69DF26293D4CE43F7EB77E7AA6E5E2
Requests: 1 HTTP requests in this frame

Frame: https://my.getadmiral.com/sticky-bubble?propertyID=A-582E614B6A735F3E706A00D7-2&bgColor=rgba(25%2C114%2C120%2C1)&iconColor=rgba(255%2C255%2C255%2C1)&horizontalAlign=left&verticalAlign=bottom
Frame ID: B18B547C86F544BAC3AD78AE68626852
Requests: 3 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=7529&campId=300x250&pubId=53576252&chanId=194640332&placementId=5502672901&pubCreative=138326616697&pubOrder=169870292&cb=1518585077&adsafe_par&impId=54a950f1-4887-11ec-93ca-024bf4a6d028
Frame ID: 8B252FE4FDCFE3D7C9DDB1FEC08C4548
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuGgUXRMSleKV1DL8yWzn6iKCzCHGgLHBjXlPHN9btFo0gOu0jzVW-B1tYTobe00-vqy90KO-2V8h6KErrZmOHmMlZTvpjcIqMtR-G_gZMHoLorPE-qUMa10n5_wpT01o3o-BJWKUcsENlax981qI60uCCSAymmy27pmfH2QTe4z9wqEssCVfUckdzVo3LshEZrRrAou5zkxqx-5QE0mUPmWLEDu-0sbetnPO3Onz2mk-O3ZE5lcrasaIp6F7tfE0XSC5t0EI00qSRjVw1dNd303dZKX-j1O4Fs_Bh_do7gE6ZFthVeD5Xisw&sig=Cg0ArKJSzKkFyeY7WorBEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: CF53C900C611F827C78432FDD477BDA0
Requests: 15 HTTP requests in this frame

Frame: https://pixel.adsafeprotected.com/jload?anId=7529&campId=970x250&pubId=53576252&chanId=194640332&placementId=5502672901&pubCreative=138326195346&pubOrder=169870292&cb=111882097&adsafe_par&impId=54a950f0-4887-11ec-93ca-024bf4a6d028
Frame ID: BDD8403C62B9F17A1058AE7AFED60F50
Requests: 2 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscsfRTbBeWFYCpfIt5fNndYXGiKUz1PYxQBf1ogQsKcUizwHwZPsSd6ruQklA3v3gHAr8FhIiePfQ5GL-qRnqJumG7DUL4VHY_01j9fp69v4aJai9mlNuUOS7JZIb957Izj3J2Uq4zvBBAUNemrRp2WY4s3L4ZkbQ3wWxA_oAAvZ_S4m8XUwsyUQtReTUKMxoiCnYZpH3smPyWh3pp1xCo4AVAiq3gK4CWxK0MgdKH3V5dJ-0RvIpX-Tf8UJjQPvZ6LPHUwlfxjQWqfmp3E_KC0u3yNn7giyz_4qKaQtCAy09OvivB7zrTNg&sig=Cg0ArKJSzIABAZFJLnq3EAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 95E9C44D680C8EC492FD15CC5966F3F6
Requests: 16 HTTP requests in this frame

Frame: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 2E2FA9BF6E4F7D8279723BF789559AD6
Requests: 16 HTTP requests in this frame

Frame: data://truncated
Frame ID: FCE84F608E9D22C9731E9653996C64A5
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/simgad/1153452811013376518
Frame ID: FB3575C5EEAA97BE9BBF867FB0303079
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/simgad/1153452811013376518
Frame ID: 1D03110520FDDAF41151F2C061752225
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/simgad/1153452811013376518
Frame ID: 035158210E5F960847555E80167DA1C9
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/simgad/1153452811013376518
Frame ID: 52F5496C3510999AA77E02E1BE8FFAAB
Requests: 3 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQ5su2qgIYyfyctwEwAQ&v=APEucNWhDBml9a-_xgYXmPMvnFcSNYb92RFkOUo2a6AJ2iwNLXndp2AlwGlE_v4zZrC-zBjPJHsiKGuLKlndr0b3NIs31u4i-1uPlYx3Yrbj8nlhtdmXKWUxkmgB-vCw4W67pwcjNnNn4OdVoFwCkthAgX9v_37ye_6REuHZZzDiwFteWK4ES-U
Frame ID: 57FA8D09379EA741B5A9398A0EDB53F5
Requests: 5 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: 37F5583D067BC8DEF8AFC938655381FB
Requests: 1 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.12.js
Frame ID: 9DF0A92238F21362A1CEE224E301FCD6
Requests: 1 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
Frame ID: AF8BCD9A4311A5F932AB4BF06B9782AD
Requests: 17 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: BD4A68B353FD8EF201AA4051F70FD3AA
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: DD8B44A317D4B317F183E23D4F0B0671
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js
Frame ID: 68C15101220B0612A3FCC9DEF88D7B3B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

OnMSFT.com - An independent source for Microsoft News

Page URL History Show full URLs

http://www.onmsft.com/ HTTP 301
https://www.onmsft.com/ Page URL

Page Statistics

312
Requests

95 %
HTTPS

48 %
IPv6

52
Domains

81
Subdomains

66
IPs

8
Countries

4275 kB
Transfer

13627 kB
Size

40
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.facebook.com/winbetadotorg?_rdr=p

Search URL Search Domain Scan URL

URL: https://twitter.com/onmsft

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/WinBetaTV

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/onmsft/

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet?text=Watch%20the%20first%20trailer%20for%20the%20live-action%20Halo%20TV%20series%20here&url=https://www.onmsft.com/news/watch-live-action-halo-tv-series-teaser-trailer-here
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https://www.onmsft.com/news/watch-live-action-halo-tv-series-teaser-trailer-here
Title: Facebook

Search URL Search Domain Scan URL

URL: https://disqus.com/by/PeterWagner91/
Title: <img class="dcl-latest-comments-avatar" src="https://c.disquscdn.com/uploads/forums/27/1420/avatar32.jpg?1369615411" alt="Peter" data-eio="l">

Search URL Search Domain Scan URL

URL: https://disqus.com/by/disqus_072hEiIebK/
Title: <img class="dcl-latest-comments-avatar" src="https://c.disquscdn.com/uploads/users/37843/8901/avatar32.jpg?1637234393" alt="LavX" data-eio="l">

Search URL Search Domain Scan URL

URL: https://disqus.com/by/JohnFreiman/
Title: <img class="dcl-latest-comments-avatar" src="https://c.disquscdn.com/uploads/users/2794/8165/avatar32.jpg?1370075692" alt="John Freiman" data-eio="l">

Search URL Search Domain Scan URL

URL: https://disqus.com/by/SilentPatriot/
Title: <img class="dcl-latest-comments-avatar" src="https://c.disquscdn.com/uploads/users/1658/6388/avatar32.jpg?1627227627" alt="BBQ McNugget" data-eio="l">

Search URL Search Domain Scan URL

URL: https://disqus.com/by/MMurcek/
Title: <img class="dcl-latest-comments-avatar" src="https://c.disquscdn.com/uploads/forums/27/1420/avatar32.jpg?1369615411" alt="MMurcek" data-eio="l">

Search URL Search Domain Scan URL

URL: http://ravenousravendesign.com/
Title: Heather

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.onmsft.com/ HTTP 301
https://www.onmsft.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 69

https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js HTTP 303
https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js

Request Chain 70

https://secure-us.imrworldwide.com/v60.js HTTP 301
https://cdn-gl.imrworldwide.com/v60.js

Request Chain 97

https://sb.scorecardresearch.com/b?c1=8&c2=6036316&c3=1&ns__t=1637250661816&ns_c=UTF-8&cv=3.5&c8=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&c7=https%3A%2F%2Fwww.onmsft.com%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&c3=1&ns__t=1637250661816&ns_c=UTF-8&cv=3.5&c8=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&c7=https%3A%2F%2Fwww.onmsft.com%2F&c9=

Request Chain 105

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=685788D2387A455B85B426CB12888347&RedC=c.clarity.ms&MXFR=053A321C468B6C60170122EF428B62EC HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=685788D2387A455B85B426CB12888347&MUID=0680AB0BAA09668E2626BBF8AB626797

Request Chain 115

https://www.onmsft.com/.well-known/pubvendors.json HTTP 301
https://www.onmsft.com/

Request Chain 118

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Request Chain 210

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPimU3D23FlZ1gWc2xITh10&google_cver=1

Request Chain 211

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YZZ2aH5RywDV9FYolBiE7wAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPimU3D23FlZ1gWc2xITh10&google_cver=1

Request Chain 212

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEBxdba0xyksw79Oi6VQOwqM&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEBxdba0xyksw79Oi6VQOwqM%26google_cver%3D1

Request Chain 213

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg3NTQ4Nzk0ODc3NjEzOTk1MQ%3D%3D

Request Chain 255

https://a.tribalfusion.com/i.match?p=b6&u=CAESELAJHXCgNxPWNWy9pK6gI1U&google_cver=1&google_push=AYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bLg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bLg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELAJHXCgNxPWNWy9pK6gI1U&google_cver=1&google_push=AYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bLg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bLg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 257

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESELr0j8BT9s0ECJ1NcQ-N0t0&google_cver=1&google_push=AYg5qPJp3oLGMroJIuHtxzqHo-Eb7HPJcmCFKDgTE6ISfWPRh8ZL-Ri1J3R5uC-gEliF-Q0TucDQY6imhtsk7B5bOxAUcNRAO1tfIg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJp3oLGMroJIuHtxzqHo-Eb7HPJcmCFKDgTE6ISfWPRh8ZL-Ri1J3R5uC-gEliF-Q0TucDQY6imhtsk7B5bOxAUcNRAO1tfIg&google_hm=Mzk3MTkyMTUwNTUxNjM5MDEwNw%3D%3D

Request Chain 258

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEEm1y7Klc-JOremKAL1J794&google_cver=1&google_push=AYg5qPI6GM9YZ2GD3e_ATkZUWTuZcZzsVpOaF9Ljnr3C5ALKE3aanMofoeQIQP2Z3l9450s-m4Pw5QRT5UBneYVLI35shqFydvIbag HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEEm1y7Klc-JOremKAL1J794&google_cver=1&google_push=AYg5qPI6GM9YZ2GD3e_ATkZUWTuZcZzsVpOaF9Ljnr3C5ALKE3aanMofoeQIQP2Z3l9450s-m4Pw5QRT5UBneYVLI35shqFydvIbag HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzIwNTA2NjE2NTA4MzM1NDY1MQ&google_push=AYg5qPI6GM9YZ2GD3e_ATkZUWTuZcZzsVpOaF9Ljnr3C5ALKE3aanMofoeQIQP2Z3l9450s-m4Pw5QRT5UBneYVLI35shqFydvIbag

Request Chain 259

https://rtb.openx.net/sync/dds?google_gid=CAESEBHdEFK6TNOp9VUI0yk_gQA&google_cver=1&google_push=AYg5qPLrukRstNUMYO8XWHntHXmY8xcM68T4_aMJsNunEVS4Ea_fNIGxcpqmotBsEqlVPUtPpstY6Fs2qZI5vzrbssxUXexSp357 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLrukRstNUMYO8XWHntHXmY8xcM68T4_aMJsNunEVS4Ea_fNIGxcpqmotBsEqlVPUtPpstY6Fs2qZI5vzrbssxUXexSp357&google_hm=tgUTnL35i-C_-VE5SPUb3A==

Request Chain 260

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_cver=1&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1

Request Chain 298

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=dc423def-06ad-4fb4-a386-363c0a8315a3&gdpr=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPJSQ4p0-6Jdfhkn_v9aPYs&google_cver=1

312 HTTP transactions
14 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.onmsft.com/
Redirect Chain

http://www.onmsft.com/
https://www.onmsft.com/

157 KB
26 KB

1187ms
1110ms

Document
text/html

104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4c0eb329993657c2feb1afd587efd8fd987fea96465907c2be866be558ed03bc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-type: text/html; charset=UTF-8
cf-ray: 6b025b8fc9af3622-MAN
last-modified: Thu, 18 Nov 2021 15:29:57 GMT
vary: Accept-Encoding
cf-cache-status: BYPASS
cf-apo-via: origin,page-rules
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KoC2GlhDt8aZNDEGRuydjEejsnXHxXJca3mMyLdiD7dsrIHVClq5yLGoLtMEbownPyIGubyZkNmJWFbvYRDxIvxzoPLAzmuWZDBo9RIgkLSEnIRp3qk1QanlCqFx8rol"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
content-encoding: br

Redirect headers

Date: Thu, 18 Nov 2021 15:50:59 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Thu, 18 Nov 2021 16:50:59 GMT
Location: https://www.onmsft.com/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uqjZ42gORSufDbBkbCI1966amXEr0Ysgqv4zcq2ucqfi%2F1vhtZw6F1j%2B4EatiXIUIdlVAHV1MgeKb4P2uC6wU%2BkBlPSElcu45DHtRac1QpNP8uC%2FP0xQfIHYeWpdB3yV"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 6b025b8efd0e54ac-MAN

GET
H2 200 onmsft.com.js Show response
cdn.nsstatic.com/ns/ 461 KB
145 KB 108ms
26ms Script
application/javascript 2.16.186.144
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.144 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-144.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 82d060cc3dc6937c8718d53041dd21b0caf9fc0ae4421aa1f17afe26eb6f2b51

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: 4WSfN0EsTEMMTIrJ3TFRze.D.h7WDpzJ
content-encoding: gzip
last-modified: Thu, 18 Nov 2021 10:54:31 GMT
x-amz-request-id: DCQEGEK5CS0NMG13
etag: "ccb5f39d1da2fe9fc71ca918bc677ee5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=1910
date: Thu, 18 Nov 2021 15:51:01 GMT
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 148085
x-amz-id-2: MVdGtvqr7LDhjfJjDAPX4RHFIxNRNmor0NoRt1KgF/Kmqh8TWuA3YDQI7dMpCOq30bu/FwdRwNs=
expires: Thu, 18 Nov 2021 16:22:51 GMT

GET
H2 200 tyche.js Show response
cdn.intergi.com/hera/ 168 KB
54 KB 159ms
110ms Script
application/javascript 2600:9000:211e:f800:14:2602:6e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergi.com/hera/tyche.js
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:f800:14:2602:6e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 81203f5c4851e1731ba31db18c9a0a62668d43eabc4192da5c318034d2cdc1de

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
via: 1.1 dca6db3c8f31f3cd48bb06d78a8be625.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
cache-control: max-age=600, public, must-revalidate
content-encoding: br
x-amz-cf-id: XrEfhmpJSvHAbOE0F02O8XW0S4EpkcJ_M0C5r30JXtsGCKV8HLKgyw==

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 143 KB
51 KB 79ms
50ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d725b40a340267e4a4d620d012e4310535cf29ce0379b4848e20111e8574a20d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51228
x-xss-protection: 0
server: cafe
etag: 10710638980496034842
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 18 Nov 2021 15:51:01 GMT

GET
H2 200 style.min.css
www.onmsft.com/wp-includes/css/dist/block-library/ 79 KB
11 KB 72ms
71ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 642389
x-xss-protection: 1; mode=block
last-modified: Wed, 21 Jul 2021 01:34:53 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"60f779bd-13abe"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gH2MpntI5mRPH2RL1oVqRXvshYNaETzGf1StSGD%2F7mCgyZuehdwXy51DJ63ja%2B6K6I8us8qR0J3fJrVUWb1aD7TAXXJgEkykPRK2rLXENLYhQEEkNaKz3%2FZve46QLP7F"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96d8053622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 mediaelementplayer-legacy.min.css
www.onmsft.com/wp-includes/js/mediaelement/ 11 KB
3 KB 76ms
74ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.16

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5f735862-2bf8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HwLtmtkExRsAUQKGNLWNy7yKsMdgUjVpLhDAR2Jbbd2HInbUR320Mfu5v3WhCEvpYJpbsefi%2Bt1MfhAP%2BwRcscX5nY4ugGqzrovurKNodywdPhnfPBS1DNnzAsZ51FKu"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96d8063622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-mediaelement.min.css
www.onmsft.com/wp-includes/js/mediaelement/ 4 KB
1 KB 42ms
40ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=5.8.2

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 642389
x-xss-protection: 1; mode=block
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5cfaccce-105a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ziF9zhJNNQI0OjG%2F2x9KNQxWaoDbvQ34Rjbfn50eLqxwgq%2Fwavmvp5NJRNGAl%2FKQslfiBURrT3RvOLXSltllHssnaIE9Lyc%2FA%2BrHhUy%2BLp0cpfDt4eQfq6pkip9cvgPW"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96d8093622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 secondline-psb-styles.css
www.onmsft.com/wp-content/plugins/podcast-subscribe-buttons/assets/css/ 6 KB
2 KB 72ms
70ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/podcast-subscribe-buttons/assets/css/secondline-psb-styles.css?ver=5.8.2

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

10874bfbd8b6d4a52eadf63e448622161b6d7f174084758557c12cfd22f38d36

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 642389
cf-polished: origSize=6514
cf-bgj: minify
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 13:53:56 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"6140a974-1972"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8qW0UNkeeBK9h9jD9s59%2FxRKgGC08Rck%2FQBzG%2FalYvcVLJ68Un4QGHWFLVsrbKNO7OypfiV4%2FATGIba7UTh0ylXWwy4VT%2BCnS8qdIq567Xs1z%2FcwSf34oU497K6JiPDC"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96d80a3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-show-posts-min.css
www.onmsft.com/wp-content/plugins/wp-show-posts/css/ 3 KB
1 KB 45ms
42ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/wp-show-posts/css/wp-show-posts-min.css?ver=1.1.3

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3982be2c95b6e0cc6918d2a1c8d993a812a0873a393acb8b5a65c0dafa68e0a8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Jan 2021 01:53:45 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5ffd0129-d9e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y89CJeJbBq6FqTsEtz7MibraYtgQtR8ZoUJ4fQ1X8kB7l0T%2BHzZJdLqrdANldpdvtyDS8H37%2BGqsy5%2FIjOc7totfNQHNplFbkXfQht1lL9YugU%2BxIAP2i16v41tegWmZ"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e80e3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-show-posts.min.css
www.onmsft.com/wp-content/plugins/wp-show-posts-pro/css/ 7 KB
2 KB 72ms
70ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/wp-show-posts-pro/css/wp-show-posts.min.css?ver=1.0.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

da05e8d8fd53ff2e65e53a572be3999483ca18f9a72c4bbd66ab1098c4946210

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Mon, 18 Jan 2021 23:50:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"60061eb4-1c17"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v8wtMGx9WESmvBlBO4l7wCkZQoKe2BPhWemI8II57qvQFk99of6HYawlcH7wST%2BeXcQclwi2KDsumLecph4GeOLkfloPe4gfs%2BKXp4cz%2BpKE9%2B4M3DAqTJnbINQ926Ik"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e80f3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.min.css
www.onmsft.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/ 438 B
506 B 42ms
40ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/easy-table-of-contents/vendor/icomoon/style.min.css?ver=2.0.17

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b88fca268e1352a0922f301c6b88f0499606c01faa8d0718de11a8153a5edc3a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Tue, 06 Jul 2021 16:53:27 GMT
server: cloudflare
etag: W/"60e48a87-1b6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iemn5mRp%2BTH%2FEX9hk29U1veTVgjf6%2Bl2CPfZS5Bol0GTjRaR4lFLBMLzEsbcsi8HFp6guYRKx4c2lZBRE4yH3h%2B3rHUClCYGgRAIsJpXILPCXajHBTgixcU8Rpv%2BSasg"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e8113622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 screen.min.css
www.onmsft.com/wp-content/plugins/easy-table-of-contents/assets/css/ 5 KB
2 KB 43ms
40ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/easy-table-of-contents/assets/css/screen.min.css?ver=2.0.17

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

22af5d3bf749542c2d95975186991b7b8c1e0766449c3fdeab55d57eb0d1ffdc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132073
x-xss-protection: 1; mode=block
last-modified: Tue, 06 Jul 2021 16:53:27 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"60e48a87-13ef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EdvLfN9EkSX9IE63Ay5pWvMxMO2%2Fmg8aC3DzN5%2BEm9%2B3APdY4H8TI1a241WrXhuw4cjjJvrC7UfKVCHyLBo2oGKnRxgfnYud8NR6k4308EtTGz1XI%2F6EBXZUFaN70Nwm"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e8123622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wpp.css
www.onmsft.com/wp-content/plugins/wordpress-popular-posts/assets/css/ 391 B
634 B 70ms
68ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/wordpress-popular-posts/assets/css/wpp.css?ver=5.4.2

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

544655deb2ee0c64031ce29769c557f467a81dc635a70f19f348869a224fd8a3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
cf-polished: origSize=1585
cf-bgj: minify
x-xss-protection: 1; mode=block
last-modified: Tue, 07 Sep 2021 13:20:27 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"6137671b-631"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UqR4s5mZ97Ybl8iNHxohWkj3HnV9wrga1%2BR26mksiSfJkAvXrLGiVNEXYESdsufJvpV8a3jo3aveetKqezc6S%2FmEhmtIouCGOxKkTj4lyNaDwumZDt5J2k45hZmVL5uU"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e8143622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 fabric.min.css
static2.sharepointonline.com/files/fabric/office-ui-fabric-core/11.0.0/css/ 331 KB
32 KB 105ms
24ms Stylesheet
text/css 104.111.225.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://static2.sharepointonline.com/files/fabric/office-ui-fabric-core/11.0.0/css/fabric.min.css?ver=5.8.2
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.225.185 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-225-185.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: a934621dc97e4ded859fe0b4855b8a5359575f95b723812c92d776b4d98abc77

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
last-modified: Mon, 22 Jun 2020 16:27:34 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D816C92B1CA4DB
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 4e9ea50b-c01e-00a7-61b3-d66eef000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=30650693
x-ms-version: 2009-09-19
content-length: 32705

GET
H2 200 widget-areas.min.css
www.onmsft.com/wp-content/themes/generatepress/assets/css/components/ 3 KB
1010 B 43ms
41ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/themes/generatepress/assets/css/components/widget-areas.min.css?ver=3.1.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6b4122b94b82886e32952c07c78d342647b3a38a2834f4489e0922308a95eab

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Wed, 27 Oct 2021 15:05:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61796aa2-d1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bSiOwj%2FBtBO%2BCDrurqI0zSYkz%2BDBqIDUsDevTTyIBSQNvuQiRsWaIy%2FaaLJBfEZvkkWxEQhz1Acwj0AKL0DXG3mv4B8ZrZXtC9xYegL1am4ZffrKwWM8SDeWJzuGtBaJ"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e8153622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 main.min.css
www.onmsft.com/wp-content/themes/generatepress/assets/css/ 19 KB
5 KB 70ms
68ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/themes/generatepress/assets/css/main.min.css?ver=3.1.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33a3b2b4bb13ccc6ea24e09ac28cf3934212a8191289ff8e032b8a25d84997f8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Wed, 27 Oct 2021 15:05:06 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61796aa2-4c36"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=neu%2FqYnUx6ikUD73Jxh4bup6VdnmeUxgs4aqAAkRnfWSFhBpF0OoCJK4lqv6LUzwJ%2FevVkxbR0ecVsfuRvxhOZOlcjdlPv592Byr%2Fr%2Bd618VJMiUbRqW523r7ByZlmwI"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e8183622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 widget.min.css
www.onmsft.com/wp-content/plugins/disqus-conditional-load-pro/assets/css/ 1 KB
650 B 71ms
69ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/disqus-conditional-load-pro/assets/css/widget.min.css?ver=5.8.2

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

608df1d6ecc4720a3cddee4abdb6e9da22c0a52c6fdb2b3f37ac21d8507f0122

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 642389
x-xss-protection: 1; mode=block
last-modified: Wed, 24 Mar 2021 16:37:29 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"605b6ac9-564"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e9B4TSQ%2F7wgqvpkDsfninWT0txiqiey0Pp4IbpN2aoi1V5StU4zUBXEx1gI4wltag1biUscmY7DqHRw%2BlPe6Mrk7uA7Vdr31enuCVR3B8pPuKazcmp1ZcG95WY8LtSu4"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e81a3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 default.min.css
www.onmsft.com/wp-content/plugins/tablepress/css/ 5 KB
2 KB 45ms
44ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/tablepress/css/default.min.css?ver=1.14

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

97ce1e1f5dbfda35ac979b593e79e1673a3e725790339d767e4a6ca6e94a4828

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Tue, 20 Jul 2021 17:46:55 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"60f70c0f-13e4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cu3Q0cOQxQFfokGDwhOJ8HwBShJdID8x1t5mHXBmW5qNO83bbUX%2BFMnLDB6L%2FJmTIiSpx7SJ3DSeybXvmOVfaWJSZD%2B%2FU4DSInOafZvBw4eWousDkCn1MLN6qmLUp0RC"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e81c3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.min.css
www.onmsft.com/wp-content/uploads/generatepress/ 9 KB
2 KB 42ms
41ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/uploads/generatepress/style.min.css?ver=1635775124

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fe4f1f5764ef817a6b57ed82ed0f1f166f81936f7f0b6c645a64d6e05bad86d2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Mon, 01 Nov 2021 13:58:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"617ff294-24a3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bvD24OsPJsrscgGUpTcbKKGTGMP3qxhrKdzvNQ4lfPLJ5%2ByGPnVVvjyreFUbUGEu3e7%2B6gmksNZt6NOcFVNhy93aW%2BUainWstXh%2BTV0c0OgdBPuFCx1XkeLGUsrO38mO"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e81d3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 style.css
www.onmsft.com/wp-content/themes/generatepress_child/ 11 KB
4 KB 43ms
42ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/themes/generatepress_child/style.css?ver=1632317050

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de39bdc1a44f5b3c9cf0e8991933d40717ac10e047eab53b89e355e1bc75b017

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
cf-polished: origSize=14430
cf-bgj: minify
x-xss-protection: 1; mode=block
last-modified: Wed, 22 Sep 2021 13:24:10 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"614b2e7a-385e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rPIlE3PGvKoOsz2L7hqApXKOSjigevfMb0WxtUQIgDFrJW0UCOedR%2FIv5sL0KB%2BUBoN5cmb9DEtqFwlbXQL0Yz2zMiCS5lh9HHSjTiQJ5f5%2BU4SofI%2F8eInl0JUqrRX2"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e81f3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 main.min.css
www.onmsft.com/wp-content/plugins/gp-premium/secondary-nav/functions/css/ 7 KB
2 KB 49ms
47ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/gp-premium/secondary-nav/functions/css/main.min.css?ver=2.1.1

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b8ea3665c171dfb165266c135c84516e4add691e3ecbf4f03b3272557cb70e2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132073
x-xss-protection: 1; mode=block
last-modified: Mon, 01 Nov 2021 13:58:42 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"617ff292-1d07"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FASh%2BMChjaW4yyKzXb6y3eT8U9%2B595gTQjPhkvM2Uxu8224OxOsV5juXPGFZRK1BbQpwveGWWODyDaG%2BYEV43yHIYCCuNGgau87KxTi45%2FoGkF0bNQA2oH6Znr28tzGx"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e8213622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 main-mobile.min.css
www.onmsft.com/wp-content/plugins/gp-premium/secondary-nav/functions/css/ 3 KB
964 B 48ms
47ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/gp-premium/secondary-nav/functions/css/main-mobile.min.css?ver=2.1.1

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

df88df96f09d9747755aa2b1f44bc857078fe9a8b6807897ed99d366d7271b20

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Mon, 01 Nov 2021 13:58:42 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"617ff292-a23"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gHI1w60tO%2FqHx0p3iJU0KHUsc9L3cKQBffzM6Nwc5LoZ3mR2t%2BVpuar3xmPAi6%2Bq2tKRJuoJ2fCHdAIMQKehYvw34KilCUc4Gfx%2B5PX6a0urpYICBZbSAWv9rI9lVEoi"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e8223622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jetpack.css
www.onmsft.com/wp-content/plugins/jetpack/css/ 85 KB
17 KB 49ms
48ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/jetpack/css/jetpack.css?ver=10.3

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a4f9c1995de9f92f05f1a5cd0c4987e359e1aa41613bb6a33f9c82837b29e6d8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
cf-polished: origSize=87188
cf-bgj: minify
x-xss-protection: 1; mode=block
last-modified: Tue, 02 Nov 2021 16:45:53 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"61816b41-15494"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EgytuPeT6hW9kvEkqh%2BNNMJJNaGBTcsKlUmFvUtw9%2BSPXIn1r3EEC6lzlxhEZvempWKrBZWqCuVhkmbPYeSIY5WMSKF6f6QMG2T4uvzhKtwTSyF9uNhu1k8kIed9V1la"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b96e8233622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.min.js Show response
www.onmsft.com/wp-includes/js/jquery/ 87 KB
32 KB 58ms
58ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Wed, 21 Jul 2021 01:34:53 GMT
server: cloudflare
etag: W/"60f779bd-15db1"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V6KUe874Bty0egolHXaa5XKHmIGubbd44Tv0FcRQjeqAIPJ4fGmaiIioENwZrRUoZgzM2sv2WavEk5I%2F9dHzHJsYCyU7eIFDipXEEvpFGNjLTzn7CiNYWm891LnT%2B4Qe"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b96e8243622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery-migrate.min.js Show response
www.onmsft.com/wp-includes/js/jquery/ 11 KB
5 KB 46ms
45ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Thu, 19 Nov 2020 09:31:13 GMT
server: cloudflare
etag: W/"5fb63b61-2bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OHt5J1E0HpXP5Ch1Wujk7N2BnSpMsJ8Ec67A8jX%2FTRcKWXgrFJVNqGWpXK1pQTJ4OT0Dy1j9S6jzXOyP8zDbzfW0%2FebBIZTqJs6DxqOZKyW67ggUxYWPSlFSPnopxwHl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b96e8253622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wpp.min.js Show response
www.onmsft.com/wp-content/plugins/wordpress-popular-posts/assets/js/ 3 KB
2 KB 69ms
68ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.4.2

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ace4208545fb0ff5ea87fbe1470d3bf0af8e73d7d52fea869966c4b9d8c78a60

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:00 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132043
x-xss-protection: 1; mode=block
last-modified: Tue, 07 Sep 2021 13:20:27 GMT
server: cloudflare
etag: W/"6137671b-bc3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uHrA%2FNQ1l2jmCdsgW3ghqnpUJ2LSG1wT3Ej3OYr7aIt5bAtcfUeclLR3bxsmZYtRABPVarEdcKs1FKpsGfK5TOS%2F1LnQHqXzE2kyEHjRUcb0a7da02ooA7sjzn7bhI89"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b96e8273622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 launcher.js Show response
teams.microsoft.com/share/ 34 KB
15 KB 107ms
50ms Script
application/javascript 2620:1ec:42::132
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://teams.microsoft.com/share/launcher.js

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:42::132 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e0110424e9bab1a8121139a915743736e98ec8f432f221db9e3b704a14a374b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=2592000
content-encoding: gzip
x-content-type-options: nosniff
x-ring-info: web: general [assigned], mt: general [assigned]
date: Thu, 18 Nov 2021 15:51:00 GMT
requestid: |51f622c7c426f448a702ad4ea0cc5d4d.36ccd2c230de304b.
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: no-store, no-transform, must-revalidate, no-cache
x-msedge-ref: Ref A: A1EB9B1C9F0C4EB5AA5915B74BDBD5E5 Ref B: MUC30EDGE0211 Ref C: 2021-11-18T15:51:01Z
timing-allow-origin: *
x-xss-protection: 1; mode=block
expires: Wed, 17 Nov 2021 15:51:01 GMT

GET
H2 200 cropped-onmsft-logo.png
www.onmsft.com/wp-content/uploads/2021/03/ 2 KB
3 KB 42ms
38ms Image
image/png 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/03/cropped-onmsft-logo.png

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8f65aee51ad720e50384aca26eaa85563f1d6f656ae418c687594e7536d0dea

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132042
cf-polished: origSize=2316
content-length: 2314
x-xss-protection: 1; mode=block
last-modified: Mon, 08 Mar 2021 21:32:23 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "604697e7-90c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Iu4WR9lXILvv%2BccXxemtjg6fZo807wQCcmAdkXuBfG8aLDnEXjo%2B5Z54XeZVvG3%2FmI0s3E%2FBF1DUJhR0KEhGiyrcUzJGT1m7tAab8V3P4hJ3RpzBJIPFuQlT7QkAPQuv"}],"group":"cf-nel","max_age":604800}
content-type: image/png
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b98cbff3622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 style-min.css
www.onmsft.com/wp-content/plugins/lightweight-social-icons/css/ 8 KB
2 KB 54ms
53ms Stylesheet
text/css 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/lightweight-social-icons/css/style-min.css?ver=1.1

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14b307ca014eb6ef91b493be723343b71a1b8e876d20522e794cbe74c8f7cd6a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132044
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Jan 2021 01:53:41 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"5ffd0125-1f35"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8jIn4jE6eYkNyYPqLdssQ7m7rm4a6WGxPqgP0xVtTRaG8Rp1BdTkdqMMgohrtwNmhS6Iffc5c11dfujTTLsyFuSHIF7pfHaMlBNQ2zZ2zgCvs%2B046pG0ZMZR3UTSm8LY"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=315360000
cf-ray: 6b025b97fa793622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 lazysizes.min.js Show response
www.onmsft.com/wp-content/plugins/ewww-image-optimizer/includes/ 11 KB
5 KB 50ms
49ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/ewww-image-optimizer/includes/lazysizes.min.js?ver=630

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a1790a7910ec2ecb48fd04ea34066eb3848b0b25fd58ba901583ef0ce447dfa8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132044
x-xss-protection: 1; mode=block
last-modified: Fri, 15 Oct 2021 14:02:54 GMT
server: cloudflare
etag: W/"61698a0e-2cf3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CuqFnq%2FO5krnscIoVhVsNVCfEtv2UCZE7hS4aiCeTwRHPfex3WB1kmjQBxdpKKM6sbNqB7X653fs61ddQC6L5qLw%2FOIGZisNvxoeFCCbSQ0MbhB3aQXAZAfyrRCZMTZP"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b982ac23622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 embed-scroll_start.min.js Show response
www.onmsft.com/wp-content/plugins/disqus-conditional-load-pro/assets/js/ 2 KB
1 KB 42ms
42ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/disqus-conditional-load-pro/assets/js/embed-scroll_start.min.js?ver=11.0.6

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1e56e1d859582ac27c8ed511adf786fcdb2ea46673e6fccacc25a1505c6d8dc2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1131953
x-xss-protection: 1; mode=block
last-modified: Wed, 24 Mar 2021 16:37:29 GMT
server: cloudflare
etag: W/"605b6ac9-602"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zgSTh66t81OKGg%2B%2B7b%2BZK0GrhAdFXqwsFW6F8%2FBulpnJ85r6IUFQ%2B1Vb72ub8Wbfb849WXqh1gWU1XY3sHvzH1ySFmWfWJft9S24pQUUFN39XzG60qPowF1Yi5Y7kx9M"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b987b473622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 modal.min.js Show response
www.onmsft.com/wp-content/plugins/podcast-subscribe-buttons/assets/js/ 5 KB
2 KB 41ms
41ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/podcast-subscribe-buttons/assets/js/modal.min.js?ver=1.0.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ecf917978118862ae1fc715ef2f5d7cf541d22cf515bc480c07324037b8bba01

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132044
x-xss-protection: 1; mode=block
last-modified: Tue, 14 Sep 2021 13:53:56 GMT
server: cloudflare
etag: W/"6140a974-13d6"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jZkKOZ8lMSbIgHaG5fhWjxdgKjwDe1ABd1l0GjD2bpMVbonhnxgKjHnUvN1a2%2BLfwiEAhDX%2FlG6cp4ACjqctemB4hjqGMVLO7oeb61rQTEzE7dTsS80KlorhS%2BoqPKDY"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98bbb93622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 menu.min.js Show response
www.onmsft.com/wp-content/themes/generatepress/assets/js/ 7 KB
2 KB 44ms
40ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/themes/generatepress/assets/js/menu.min.js?ver=3.1.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132044
x-xss-protection: 1; mode=block
last-modified: Wed, 27 Oct 2021 15:05:06 GMT
server: cloudflare
etag: W/"61796aa2-1b1c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ECOsw%2FAcFkNvmtBrPBdoK60BSXTcWOPkTh5o57yOPGe5wVfGmPurDpzc3i3niILWNn9arelFAIfRhSd5xjgXN34fx7f7CyB5%2FQu%2BfFZpV%2B20G7gAzzjNBta5jzaAdeW"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98cbf33622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 navigation-search.min.js Show response
www.onmsft.com/wp-content/themes/generatepress/assets/js/ 2 KB
1 KB 45ms
40ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/themes/generatepress/assets/js/navigation-search.min.js?ver=3.1.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4d0c6a094ec876c2dbea780dac5655e44bc1ec2b0c9c492f8513581879c89c5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132044
x-xss-protection: 1; mode=block
last-modified: Wed, 27 Oct 2021 15:05:06 GMT
server: cloudflare
etag: W/"61796aa2-858"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dbqXBuy2KIoEtSbRbtLooNzbQdTSGYm1n7XPM5uco33Y2%2B9EwGknzMEpO3DZLObNKTgQJPouob02GB6DQQsaW%2By1iPk43Uk%2F5844huQSCdexoCV1Gina4g3d8uz2WUDx"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98cbf73622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 back-to-top.min.js Show response
www.onmsft.com/wp-content/themes/generatepress/assets/js/ 763 B
659 B 50ms
46ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/themes/generatepress/assets/js/back-to-top.min.js?ver=3.1.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fa6953b24e42640645ebc36a7bdead13b10abdddd28abec1d8d7904d329e6cd0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132044
x-xss-protection: 1; mode=block
last-modified: Wed, 27 Oct 2021 15:05:06 GMT
server: cloudflare
etag: W/"61796aa2-2fb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fX3mTrm8%2BB8B5DHSKW%2BVfddCmgXiawsDtdYE0oSWDCHlyGAsaK%2FcJxVUb7l9SUKygnShyA9JV7VzHaNRygAP8IvKs%2BGC4q%2Fy0z4Sk%2BqSu3XOnhBzq0VobnTeMfXbfkUn"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98cbfa3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 twitter-timeline.min.js Show response
www.onmsft.com/wp-content/plugins/jetpack/_inc/build/ 331 B
516 B 40ms
36ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/jetpack/_inc/build/twitter-timeline.min.js?ver=4.0.0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132044
x-xss-protection: 1; mode=block
last-modified: Tue, 02 Nov 2021 16:45:53 GMT
server: cloudflare
etag: W/"61816b41-14b"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e6gku93AqFAJpQPxfeDaOk%2BCTuye%2Bzn7Zoa5VQ1dlaMxo9daMwdIzl9hPYNXjt%2BnfHcfG2mLxIpQ2Z5V92yHgOkVC8GNztOJpfdaR7m0lc0k%2BYHSGhLAobGrOyIpplWc"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98cbfb3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 wp-embed.min.js Show response
www.onmsft.com/wp-includes/js/ 1 KB
1021 B 46ms
42ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-includes/js/wp-embed.min.js?ver=5.8.2

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 642389
x-xss-protection: 1; mode=block
last-modified: Thu, 04 Feb 2021 04:29:31 GMT
server: cloudflare
etag: W/"601b782b-592"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4mqzMNPsIC%2Fu2xJB8TYYyCFbSpnsuyZOLGP5WiwERnvGaOE3p0we%2BURaU0VxPPl8SSMmdDeKVIq65hkILMXRkP7AzJCBRwrKHZpDRYxrmWrm0j0By2qZZGTAuu9wVz2o"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98cbfc3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.tooltipster.min.js Show response
www.onmsft.com/wp-content/plugins/lightweight-social-icons/js/ 17 KB
5 KB 46ms
41ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/lightweight-social-icons/js/jquery.tooltipster.min.js?ver=1.1

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db8827df299fb574b5b1019eca3d316bec9ebefcfd279f9bd0eb591bd991abf2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1132044
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Jan 2021 01:53:41 GMT
server: cloudflare
etag: W/"5ffd0125-4322"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DxisIQeNuK830WbiQ6lP2ATDEApNRtb%2BELDIorUy0aEf%2FP2RrKV7CNpkQ6NnxvZyiz5YdLPTzjbs0zyS26%2BGGDfOP0hY%2F9FxADgFtouuIGXOo7kV9QtpW%2FEWzo30USLE"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98cbfd3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 jquery.matchHeight.js Show response
www.onmsft.com/wp-content/plugins/wp-show-posts/js/ 5 KB
2 KB 46ms
42ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/wp-show-posts/js/jquery.matchHeight.js?ver=1.1.3

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8f1b51337be99b356f1400fd895035f8022d4fa8a99b17c16a3500445fab1b73

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 78351
cf-polished: origSize=12197
cf-bgj: minify
x-xss-protection: 1; mode=block
last-modified: Tue, 12 Jan 2021 01:53:45 GMT
server: cloudflare
etag: W/"5ffd0129-2fa5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kVnMp%2FEy97yv4rzTiIJVCgn58mzU0QUjsB1UJa6rYeh9biVQY2uAd5fireen%2Fj8UJfRSomnEsvpsIP%2F%2FCwNVOHE15bcnnWh886cdmiorQggN9g3IRDcGwtsP1dXJXQE6"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98cbfe3622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 e-202146.js Show response
stats.wp.com/ 9 KB
3 KB 50ms
15ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202146.js
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-nc: HIT ams
date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
server: nginx
etag: W/"5c6340e3-350a"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
expires: Thu, 10 Nov 2022 16:11:59 GMT

GET
H2 200 lazyload.min.js Show response
www.onmsft.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/ 8 KB
3 KB 39ms
35ms Script
application/javascript 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/wp-rocket/assets/js/lazyload/17.5/lazyload.min.js

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 522777
x-xss-protection: 1; mode=block
last-modified: Fri, 12 Nov 2021 14:37:19 GMT
server: cloudflare
etag: W/"618e7c1f-2063"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MoRBXyBYOQedS53OsBtZZV6oN7OvrOvnouU0j1j3nGeX9P8%2BAz199L8YCYdKMcOO2GdE9szZKOJ%2FqB02gNWfaRxuFzk5gB6mnRgG9%2F2bJMw%2BYMLQkTRbCPwjpbOLyiUf"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=315360000
cf-ray: 6b025b98cc003622-MAN
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 v64f9daad31f64f81be21cbef6184a5e31634941392597 Show response
static.cloudflareinsights.com/beacon.min.js/ 13 KB
5 KB 156ms
99ms Script
text/javascript 2606:4700::6810:5f41
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:5f41 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5bf0a170ae91f1bb8d0c94381a74ab8b85f938bf31bf18a9c8e3b835250d3be6

Request headers

Referer: https://www.onmsft.com/
Origin: https://www.onmsft.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
last-modified: Fri, 22 Oct 2021 22:23:12 GMT
server: cloudflare
etag: W/2021.10.0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
cf-ray: 6b025b991be35a3d-MXP

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 64ms
21ms XHR
application/javascript 13.32.21.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.21.201 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-21-201.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: gYbY2ORQY5Qmsyt0ob0SiGH6tjIhuo4B
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 39038
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Tue, 09 Nov 2021 22:55:20 GMT
server: AmazonS3
date: Thu, 18 Nov 2021 05:05:43 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: WNkqAEH77W6iTlJaaPGfQL2CSEX19F8rvshjy2u4uIqjtXHAfQPlqw==

GET
H2 200 geocc.js Show response
g.pcmag.com/ 184 B
265 B 48ms
19ms Script
application/javascript 2.16.186.144
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://g.pcmag.com/geocc.js
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.144 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-144.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 99ecb14ec0a4e706ee386f1bde1a4684119fa8e100f24821f71f7fa75ccd481d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-length: 184
content-type: application/javascript

GET
H2 200 nsgpt.jsonp Show response
ns.zdbb.net/ 879 B
647 B 193ms
124ms Script
application/javascript 2.16.186.144
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ns.zdbb.net/nsgpt.jsonp?u=https%3A%2F%2Fwww.onmsft.com%2F
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.144 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-144.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fd585b8497157f0c86361f32a9d16fc639415ee64361d7c36f9dc4b981bedf9b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/javascript
access-control-allow-origin: https://www.onmsft.com
cache-control: max-age=57
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control
content-length: 386
expires: Thu, 18 Nov 2021 15:51:58 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 77 KB
27 KB 56ms
22ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

d7bb934e518c87d758dd90505d1ed7c16de4f044fcd666156cde2050c10802c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1047 / 354 of 1000 / last-modified: 1637237136"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 26822
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 18 Nov 2021 15:51:01 GMT

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 385 B
741 B 56ms
15ms XHR
application/json 13.32.21.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=3916&u=https%3A%2F%2Fwww.onmsft.com
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.21.201 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-21-201.fra56.r.cloudfront.net
Software: Server /
Resource Hash: bf99659b83fd9ba30e7bd362202408f37498b89a0cdf0457b9913fe60ec463f0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 11:11:54 GMT
via: 1.1 0d5d2d408eb42296c7636196e25ef8a3.cloudfront.net (CloudFront)
server: Server
age: 16747
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.onmsft.com
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
x-amz-cf-pop: FRA56-C2
content-length: 385
x-amz-cf-id: yAlSRJ3YuoVxNO9fg6-6aSOzl5q-0osOpVMlFe0h85Qos9UxuSw-Aw==

GET
H2 200 videoCard.1451368a7b5e945a3252.js Show response
cdn.intergient.com/pageos/1.6.29/ 551 B
999 B 59ms
6ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/videoCard.1451368a7b5e945a3252.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 411626d5e8eb3616fad95e39e91afe59dcfd424b9492c2c43c76a5199dc69768

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 03:11:10 GMT
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
last-modified: Wed, 03 Nov 2021 12:46:44 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:bfb44d87e9e552efe6f335d770ab135a/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 45599
etag: "bfb44d87e9e552efe6f335d770ab135a"
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 551
x-amz-cf-id: l4c3rAma8fX55-b_W1YhPYewzF5-6is2kkpQ4ZyOpR9o2SXLmdOtEA==

GET
H2 200 batchHandler.292de00282b644b2ec50.js Show response
cdn.intergient.com/pageos/1.6.29/ 3 KB
2 KB 59ms
6ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/batchHandler.292de00282b644b2ec50.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 225a5d44793400c62040e70a55fc77beed0a3cbc0d7ac361abbf4085392b1e20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 14:37:11 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:39 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:de92c4772058b0bc43087610c61d14a5/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 4431
etag: W/"de92c4772058b0bc43087610c61d14a5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: fVZRfnVY4BITW79TbtH481cCVHnoK1tzNYfFQ2hZftU6DSaPGVoWcw==

GET
H2 200 banner.json Show response
config.playwire.com/1023788/v2/websites/71908/ 21 KB
3 KB 81ms
28ms XHR
application/json 2600:9000:2057:5a00:1a:1459:5cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.playwire.com/1023788/v2/websites/71908/banner.json
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:5a00:1a:1459:5cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 949192cf915ba5e7aa5ee91f12efccc64db5f7f5c99ca44e9e6a7634c1a64428

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 22:59:58 GMT
via: 1.1 vegur, 1.1 d07eabeb1ed60c06da1457f35fb5c8c5.cloudfront.net (CloudFront)
vary: Accept-Encoding
age: 60663
x-cache: Hit from cloudfront
content-encoding: br
server: Cowboy
access-control-max-age: 1728000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: hw-country-code
cache-control: public, max-age=600
hw-country-code: DE
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: 2Y9kUaaTvW2a_XY7NQNyT2b0RZhjlYiFsF5ACstd499jzQ23tvi9WQ==

GET
H2 200 moatheader.js Show response
z.moatads.com/playwireprebidheader597261727146/ 214 KB
75 KB 79ms
21ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/playwireprebidheader597261727146/moatheader.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 8e662cd2ca55a4bddd132966304a69f7643154d359c97ab4850606922be42556

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
last-modified: Tue, 02 Nov 2021 14:45:26 GMT
server: AmazonS3
x-amz-request-id: P9CXSHBDCGRCHB6K
etag: "5e40994da788591853a03ad1379eff9b"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=43542
accept-ranges: bytes
content-length: 76349
x-amz-id-2: ZcNVvok1ZAEFpeE6S8Wxb2i2sxpjOeblPvh84A+t0v4JkQWjAKLl4/SFAo1HCtZxcyzhtnaWBcc=

GET
H2 200 v2hqou17GCghnS4NOCIPBRrPgYaaQfmkICgh_Zauab57xLxEh8fkPe9Pb-eGb9dQT Show response
chickensstation.com/ 648 KB
117 KB 279ms
229ms Script
text/javascript 35.186.219.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://chickensstation.com/v2hqou17GCghnS4NOCIPBRrPgYaaQfmkICgh_Zauab57xLxEh8fkPe9Pb-eGb9dQT

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.219.42 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

42.219.186.35.bc.googleusercontent.com

Software

Resource Hash

37a8f221060570aa879aaa77d61bc2321fcdc97a7de9558a716fb40cfed41689

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; preload
content-encoding: br
x-datacenter: gce-europe-west1
etag: "c6ab1e4251f5179ce137a9976f414a3466a27e7a8d9c6a50e7cada079f55cfe6"
vary: Accept-Encoding, Accept-Language
x-hostname: c984a0b3
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
date: Thu, 18 Nov 2021 15:51:01 GMT
timing-allow-origin: *

GET
H2 200 v2zeyOdODj6skGPS-pqw5z3CLcQa_aRatwsMYSK_VZGTRviPR2kewU-H-9Q6vfqGL_morah0ZqTrc2E0Neg Show response
dapperfloor.com/ 16 KB
6 KB 272ms
229ms Script
text/javascript 35.201.98.64
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://dapperfloor.com/v2zeyOdODj6skGPS-pqw5z3CLcQa_aRatwsMYSK_VZGTRviPR2kewU-H-9Q6vfqGL_morah0ZqTrc2E0Neg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.201.98.64 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

64.98.201.35.bc.googleusercontent.com

Software

Resource Hash

5db2038f2fc6fd83f631e2991466fc9ae11d7183809a2dfa7d990fde6e19b1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; preload
content-encoding: gzip
x-datacenter: gce-europe-west1
etag: "12d826999df1350c2252b31b2097d87b3131b3bcc8fd06394e4280970b663652"
vary: Accept-Encoding, Accept-Language
x-hostname: c984a0b3
content-type: text/javascript; charset=utf-8
cache-control: private, must-revalidate, max-age=21600
date: Thu, 18 Nov 2021 15:51:01 GMT
timing-allow-origin: *

GET
H2 200 3vjoryfbqq Show response
www.clarity.ms/tag/ 1 KB
1 KB 443ms
207ms Script
application/x-javascript 2620:1ec:27::cafe:1503
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/3vjoryfbqq
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:27::cafe:1503 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: 65d4b2a87b2d915a138d7e023b49f05d61370f90d07cae5a030017b0de2f827f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
x-powered-by: ASP.NET
x-azure-ref: 0ZXaWYQAAAAC+aQyh96YgTb61O6v5BOhkQlVIMDFFREdFMDIxMwA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
expires: -1
cache-control: no-cache, no-store
request-context: appId=cid-v1:7f62cbe7-9d8b-4a41-a628-fbaa3aa5c695

GET
DATA 200
OK truncated
/ 82 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7e41ca21e421f129d3881e345f990027b66c0ab3c5580e549575f9393d117cbd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 css2
fonts.googleapis.com/ 8 KB
1 KB 51ms
16ms Stylesheet
text/css 2a00:1450:4001:811::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600&display=swap

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/wp-content/themes/generatepress_child/style.css?ver=1632317050

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b3608c1e25f786e7fa295bde2152b045f2d08ae42ae1499b5a3f1e9839c0381d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 18 Nov 2021 14:49:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 18 Nov 2021 15:51:01 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 18 Nov 2021 15:51:01 GMT

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 35 KB
10 KB 40ms
16ms Script
text/javascript 46.105.202.126
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

46.105.202.126 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

eb6883bc39782219d9eb3868c4e21acbdf949cc1a13bd35fb86bcb447488a977

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
content-encoding: br
x-cacheable: Matched cache
x-cdn-pop-ip: 137.74.120.0/27
date: Thu, 18 Nov 2021 15:35:50 GMT
content-type: text/javascript;charset=utf-8
cache-control: max-age=3600
x-cdn-pop: sbg
content-disposition: attachment;filename="id5-api.js"
accept-ranges: bytes
content-length: 10053
x-request-id: 847675762

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 101 KB
39 KB 56ms
26ms Script
application/javascript 2a00:1450:4001:829::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-WKG65QB

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

98d4dd783896cd839a5c25cebfd53ce0f74febd28be7d1679d5d4f5b115751ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39390
x-xss-protection: 0
last-modified: Thu, 18 Nov 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 18 Nov 2021 15:51:01 GMT

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v27/ 44 KB
44 KB 38ms
11ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v27/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:wght@300;400;600&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.onmsft.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 12 Nov 2021 13:52:02 GMT
x-content-type-options: nosniff
age: 525539
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44656
x-xss-protection: 0
last-modified: Thu, 28 Oct 2021 00:30:43 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sat, 12 Nov 2022 13:52:02 GMT

GET
DATA 200
OK truncated
/ 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 76bd483ba071899420c9c8428a6b5975605f69e50de11df4c009286324bb5dda

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 177 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73bb49742c8bbcd16dc2da58fae00c67a0cb96576b8bda53619ef215b0a2df78

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 fabricmdl2icons-3.54.woff
static2.sharepointonline.com/files/fabric/assets/icons/ 181 KB
182 KB 86ms
33ms Font
font/woff 104.111.225.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://static2.sharepointonline.com/files/fabric/assets/icons/fabricmdl2icons-3.54.woff
Requested by: Host: static2.sharepointonline.com
URL: https://static2.sharepointonline.com/files/fabric/office-ui-fabric-core/11.0.0/css/fabric.min.css?ver=5.8.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.225.185 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-225-185.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: c196bd11a6ada8107e9f065486e36c8db58b03b529bf891970b9336efd8a6130

Request headers

Referer: https://static2.sharepointonline.com/files/fabric/office-ui-fabric-core/11.0.0/css/fabric.min.css?ver=5.8.2
Origin: https://www.onmsft.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Thu, 18 Nov 2021 15:51:01 GMT
last-modified: Mon, 22 Jun 2020 16:25:27 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D816C8DFC24C11
content-type: font/woff
access-control-allow-origin: *
x-ms-request-id: bb35754e-b01e-0014-32e6-55ce42000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=16489068
x-ms-version: 2009-09-19
content-length: 185052

GET
H2 200 wp-show-posts.ttf
www.onmsft.com/wp-content/plugins/wp-show-posts-pro/fonts/ 4 KB
5 KB 500ms
500ms Font
application/octet-stream 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/wp-show-posts-pro/fonts/wp-show-posts.ttf?ka575c

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/wp-content/plugins/wp-show-posts-pro/css/wp-show-posts.min.css?ver=1.0.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29efe7847837e74a124c0e584030e9afa5463de12128d5d5477d548b4fa6d9a5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.onmsft.com/wp-content/plugins/wp-show-posts-pro/css/wp-show-posts.min.css?ver=1.0.0
Origin: https://www.onmsft.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
cf-cache-status: REVALIDATED
last-modified: Mon, 18 Jan 2021 23:50:12 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "60061eb4-112c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qtbg8J%2FwlbsbWMCLkZ7pOBDmZFbby%2FDl7vxnl3KUhRuAk82vVwXVJ%2FoffE%2BQ9WyJYvT3mKcyAgGbdB3HIuAqdGkE0fsmR3PYYZTUjP2w2F8AJwgOUgdsIfZUqRCmL9dJ"}],"group":"cf-nel","max_age":604800}
content-type: application/octet-stream
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6b025b992cc93622-MAN
content-length: 4396
x-xss-protection: 1; mode=block

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 123 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 61b2b568c1b892a6ad33889445bd22708ec2ba507ce7f288a18a08b3197dd1eb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 vendors~gdpr.f92225b828d740c7c57f.js Show response
cdn.intergient.com/pageos/1.6.29/ 65 KB
17 KB 25ms
24ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/vendors~gdpr.f92225b828d740c7c57f.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a87d4c2682d10f0750f0e1142e25fce055f0ae596c7a277bbaf2427ddae146bc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 02:59:33 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:44 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:9b5e3fdd31d877679a5666fe44299ea9/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 46293
etag: W/"9b5e3fdd31d877679a5666fe44299ea9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: facdBRp_rB5XOGFLRq1VdW0dvDbcrL1dSE8OSTbd_LxHERuerzPX0g==

GET
H2 200 gdpr.3ce8554fcbe8b97488e7.js Show response
cdn.intergient.com/pageos/1.6.29/ 9 KB
3 KB 24ms
24ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/gdpr.3ce8554fcbe8b97488e7.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 99676824143e650821663a625e811e4b1f74ad095dd94e2ef134fc5dc3286aa9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 06:05:13 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:42 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:27934a360f2e8bf072d593df31290def/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 36935
etag: W/"27934a360f2e8bf072d593df31290def"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: d3gRuN4cHGAn88PXvGRNhpcEEYBZroWwobOEBfVs4Np6NHkqXhe1gw==

GET
H2 200 fontello.woff
www.onmsft.com/wp-content/plugins/lightweight-social-icons/fonts/ 23 KB
15 KB 41ms
40ms Font
application/font-woff 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-content/plugins/lightweight-social-icons/fonts/fontello.woff

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/wp-content/plugins/lightweight-social-icons/css/style-min.css?ver=1.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1b6e0cc5ce7dad5ae275d7ac33c17034f27f801270805bf8d320bab919045a2c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.onmsft.com/wp-content/plugins/lightweight-social-icons/css/style-min.css?ver=1.1
Origin: https://www.onmsft.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Tue, 12 Jan 2021 01:53:41 GMT
server: cloudflare
age: 4212
x-frame-options: SAMEORIGIN
etag: W/"5ffd0125-5b20"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jT1P3qLtG0UQCnbSbfrHTL6ZHa%2FJWkLsgpCg5lq44YHVVZKv0DSNMzNmeLgNaVyAdSbqZ9yjKFxX8Ypys3aZ9XjjjA4MdsWuV1eSslSGFBLDCXB36lhfV4ttv%2B4xHo%2F6"}],"group":"cf-nel","max_age":604800}
content-type: application/font-woff
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6b025b99adf93622-MAN
x-xss-protection: 1; mode=block

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 121ms
10ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 2994
date: Thu, 18 Nov 2021 15:01:07 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 18 Nov 2021 17:01:07 GMT

GET
H2 200 beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 120ms
10ms Script
application/javascript 13.35.253.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.35.253.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-75.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 03:23:33 GMT
content-encoding: gzip
etag: W/"1827f116c73f319409b97f10b8a58ade"
last-modified: Fri, 26 Feb 2021 14:35:05 GMT
server: AmazonS3
age: 44849
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 9bca546700a965c9c77ef5b8dbe65cc4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: o8jHH2UDmHMh2qbXvfCsIAt8DjNxo3NnieouzqlOyS-MDbUlASxNMQ==

GET
H2

200

z0WVjCBSEeGLoxIxOQVEwQ.min.js Show response
cdn.static.zdbb.net/eu/js/
Redirect Chain

https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js

88 KB
25 KB

30ms
30ms

Script
application/javascript

2.16.186.144
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Server: 2.16.186.144 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-144.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d3efb7681c7115f4e3fe68d1a2869505712accffe083ea5e8a444a3aba74609d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: WzF1i.50YPv2Ve1poy58ywylBzYXr7eK
content-encoding: gzip
last-modified: Tue, 09 Nov 2021 14:08:07 GMT
x-amz-request-id: JM2HKY3Y9DNV5AHR
date: Thu, 18 Nov 2021 15:51:01 GMT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 25298
x-amz-id-2: y8KppjXwZ/nbBwUEKxwwkPeQHvOy9BWbfd9abJ7GDLEls+VUIP9BJGJX6nR9Z0Zvm63sB5FnXr4=
expires: Fri, 19 Nov 2021 15:51:01 GMT

Redirect headers

location: https://cdn.static.zdbb.net/eu/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
date: Thu, 18 Nov 2021 15:51:01 GMT
cache-control: max-age=86400
core-eu: Yes
content-length: 0
expires: Fri, 19 Nov 2021 15:51:01 GMT

GET
H2

200

v60.js Show response
cdn-gl.imrworldwide.com/
Redirect Chain

https://secure-us.imrworldwide.com/v60.js
https://cdn-gl.imrworldwide.com/v60.js

21 KB
7 KB

112ms
11ms

Script
application/javascript

2600:9000:214f:5a00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/v60.js
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Server: 2600:9000:214f:5a00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 75481bc06d1b02e50fd1cc921a7838e3af6caa9b8c0745b50182ebf29f195e20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: .KrDWJ6YcsmnfI6j8sx8eWw9CjCealBE
content-encoding: gzip
etag: W/"cc7339d315e5ab16597dd66d153a0e7e"
last-modified: Mon, 12 Oct 2020 13:35:53 GMT
server: AmazonS3
age: 42048
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront)
cache-control: max-age=86400
date: Thu, 18 Nov 2021 04:10:14 GMT
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: JF7GIf8iemO7QAVhrkc56pdO8Z89pBjiSHeeP_mkkJOmCiBzFGbhlQ==

Redirect headers

location: https://cdn-gl.imrworldwide.com:443/v60.js
date: Thu, 18 Nov 2021 15:51:01 GMT
server: awselb/2.0
content-length: 134
content-type: text/html

GET
H2 200 /
gurgle.zdbb.net/ 43 B
252 B 368ms
144ms Image
image/gif 34.228.209.86
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://gurgle.zdbb.net/?domain=netshelter.net
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.228.209.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-228-209-86.compute-1.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: https://www.onmsft.com
date: Thu, 18 Nov 2021 15:51:01 GMT
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control
content-length: 43
access-control-allow-methods: GET, OPTIONS
content-type: image/gif

GET
H2 200 watch-halo-tv-series-teaser-trailer-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/11/ 8 KB
8 KB 54ms
50ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/11/watch-halo-tv-series-teaser-trailer-640x480.jpg.webp

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6468f493433bd9493a471659f516879591aeab56d7af974055300d6aca96845c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 596
content-length: 8172
x-xss-protection: 1; mode=block
last-modified: Wed, 17 Nov 2021 08:48:36 GMT
server: cloudflare
etag: "6194c1e4-1fec"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9TtOcpuqA9P7xNoUlo3DWXPJGS%2FDzA3ZA3OE%2F%2Fty1SPM3pic51cR7zOkRClwv6BExptweS0T7Og6bvilw7wvbMqJoQPZYBknpGmWCURpfTgnhjxzZ%2Bmvo4VoBR2P%2F6Ww"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
accept-ranges: bytes
cf-ray: 6b025b9a2f1f3622-MAN

GET
H2 200 microsoft-whiteboard-windows-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/10/ 15 KB
15 KB 53ms
49ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/10/microsoft-whiteboard-windows-640x480.jpg.webp

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5a469a5ea6249c58faebabd539180650ed214c8f55d2f3e909b88e16e18bd1ac

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 596
content-length: 15366
x-xss-protection: 1; mode=block
last-modified: Sat, 30 Oct 2021 17:03:05 GMT
server: cloudflare
etag: "617d7ac9-3c06"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gqcdcsXhiU1jeCOntfFDJREho7ql5fVUBtM95jNmL%2Bc4ah3fowqpK79q2g%2FCyNkhS5ujnww8EDstpYgdfGf3EAffR%2B%2FICg%2FBNLCGSTYn35IvJQPmLPk2QUNTV2y50fos"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
accept-ranges: bytes
cf-ray: 6b025b9a3f2d3622-MAN

GET
H2 200 Internet-Association-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/11/ 19 KB
20 KB 49ms
45ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/11/Internet-Association-640x480.jpg.webp

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87c056265c6a6e8c1d6ea9385ad66dbfd5006dd6d3c73b656db2b34f2cd7b8a2

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 596
content-length: 19868
x-xss-protection: 1; mode=block
last-modified: Thu, 18 Nov 2021 15:12:37 GMT
server: cloudflare
etag: "61966d65-4d9c"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=beLQbH5b1HChniJELuJwawD%2B7Dace%2FyGp55LEZtCTky5jwb%2B6ahvv5NrZCi62R85W%2FkZ2ITGpEUopWegfFdsaUG0ArxU5XbNt4qHbKQnbMH0AJH%2FW8ySO%2BDdakmGHX%2FN"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
accept-ranges: bytes
cf-ray: 6b025b9a3f303622-MAN

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 251ms
48ms Script
application/javascript 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/wp-content/plugins/jetpack/_inc/build/twitter-timeline.min.js?ver=4.0.0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CEA) /
Resource Hash: 00a57617df99ac957720b7332f9d15449def3ebe11169d68f12c47a3cde5168d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Thu, 18 Nov 2021 15:51:01 GMT
Content-Encoding: gzip
Last-Modified: Mon, 18 Oct 2021 18:33:56 GMT
Server: ECS (mil/6CEA)
Age: 443
Etag: "a709ab1b2c0d5d5e7c19895f6e1dcbfd+gzip"
Vary: Accept-Encoding
x-tw-cdn: VZ
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800
X-Cache: HIT
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Content-Length: 29104

GET
H2 200 g.gif
pixel.wp.com/ 50 B
93 B 20ms
17ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&j=1%3A10.3&blog=144796107&post=217264&tz=-8&srv=www.onmsft.com&host=www.onmsft.com&ref=&fcp=1755&rand=0.6704231468051913
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 18 Nov 2021 15:51:01 GMT
cache-control: no-cache
server: nginx
content-length: 50
content-type: image/gif

GET
H2 200 2 Show response
www.onmsft.com/wp-json/wordpress-popular-posts/v1/popular-posts/widget/ 9 KB
2 KB 822ms
822ms XHR
application/json 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/wp-json/wordpress-popular-posts/v1/popular-posts/widget/2?is_single=0

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

39ab56ea8360e18c7757efca692a5703474a0e30102ef3e986f7f935bd5d66fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.onmsft.com/
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-xss-protection: 1; mode=block
link: <https://www.onmsft.com/wp-json/>; rel="https://api.w.org/"
allow: GET
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XitHfDVJN%2FYKbaefetnYc3aI%2Fs1GBHmdF9HYTzQID991IFmODHoRwzPcotJXpodFmUijx04FaICLtiT8eeS%2B8dKznUp5S4w0tbWtKGKfISpuX8BtFBMKRxUL0OTT1L%2B1"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=UTF-8
access-control-expose-headers: X-WP-Total, X-WP-TotalPages, Link
x-robots-tag: noindex
cf-apo-via: origin,no-cache
cf-ray: 6b025b9a3f513622-MAN
access-control-allow-headers: Authorization, X-WP-Nonce, Content-Disposition, Content-MD5, Content-Type

GET
H2 200 aws-sdk-kinesis.min.js Show response
cdn.intergient.com/pageos/js/libs/ 227 KB
63 KB 11ms
10ms Script
text/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/js/libs/aws-sdk-kinesis.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/batchHandler.292de00282b644b2ec50.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b41e0020ff5a4bec857828c37b9a425a5e0024aac1fb1519dd9cf4562f0681ee

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 23:06:28 GMT
content-encoding: br
last-modified: Thu, 04 Nov 2021 13:03:16 GMT
server: AmazonS3
age: 60274
etag: W/"dd4723e36a9cd5d1d04946ad79b9dfe6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: tFnn1EATgAcIxqMy8zhf8kmZWX_H8S15MkLrkC9Lezr_6Er42J1VFQ==

GET
H2 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/ 270 KB
97 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1197011367764122&plah=www.onmsft.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee33f1f4475d95bc43bc979a1a6dd531b3e52e226326c75471fe259f00088c9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 99572
x-xss-protection: 0
server: cafe
etag: 16480955239825126270
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 18 Nov 2021 15:51:01 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/ Frame AC3D 11 KB
5 KB 9ms
8ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20211111/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Thu, 18 Nov 2021 09:43:00 GMT
expires: Thu, 02 Dec 2021 09:43:00 GMT
content-type: text/html; charset=UTF-8
etag: 16478831307880631077
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4883
x-xss-protection: 0
age: 22081
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 pubads_impl_2021111501.js Show response
securepubads.g.doubleclick.net/gpt/ 345 KB
116 KB 29ms
27ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

sffe /

Resource Hash

be5913c6e9820dae39a9bdadbd7bfd525f076299fe92ac078cc668abc56d9550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 118768
x-xss-protection: 0
last-modified: Mon, 15 Nov 2021 09:34:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 18 Nov 2021 15:51:01 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 137 B
132 B 54ms
27ms XHR
application/json 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.onmsft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

bbb8006559ba0fec76525d893b34927bb2504d9eb8560f5f2632b26d6d7ef544

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 107
x-xss-protection: 0
expires: Thu, 18 Nov 2021 15:51:01 GMT

GET
H2 200 v2 Show response
mb.moatads.com/yi/ 349 B
525 B 143ms
52ms Script
text/html 18.171.9.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://mb.moatads.com/yi/v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5B*EjrG%3DH%3CA.a%24%7D9H%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-f9sEUFJ0XDIlaX11F1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-glpGhov6BziEcg%3D%3D&sc=1&os=1-8g%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.onmsft.com%2F&pcode=playwireprebidheader597261727146&rx=404614941320&callback=MoatNadoAllJsonpRequest_78904762
Requested by: Host: z.moatads.com
URL: https://z.moatads.com/playwireprebidheader597261727146/moatheader.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.171.9.184 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-171-9-184.eu-west-2.compute.amazonaws.com
Software: TornadoServer/4.5.3 /
Resource Hash: 30c035a23faa9b9a0f86478fad65f95c99849554bb16d57d6b56b2609cfe92e1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
cache-control: max-age=900
server: TornadoServer/4.5.3
timing-allow-origin: *
etag: "eb6ebb718c47b863b25f998f23bb83194fe8686f"
content-length: 349
content-type: text/html; charset=UTF-8

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
206 B 34ms
33ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=678711843&t=pageview&_s=1&dl=https%3A%2F%2Fwww.onmsft.com%2F&ul=en-us&de=UTF-8&dt=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1032233970&gjid=1887456970&cid=1565518977.1637250662&tid=UA-46557023-13&_gid=1686212034.1637250662&_r=1&_slc=1&z=1599357271

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.onmsft.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
67 B 39ms
39ms XHR
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=678711843&t=pageview&_s=1&dl=https%3A%2F%2Fwww.onmsft.com%2F&ul=en-us&de=UTF-8&dt=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEDAAEABAAAAAC~&jid=1664039620&gjid=286173394&cid=1565518977.1637250662&tid=UA-71939551-1&_gid=1686212034.1637250662&_r=1&gtm=2wgba1WKG65QB&cd5=OnMSFT.com&cd7=November%2027%2C%202018&z=754561637

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:01 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.onmsft.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.gif
static.adsafeprotected.com/ 43 B
482 B 71ms
9ms Image
image/gif 2600:9000:211e:1400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 16:14:35 GMT
via: 1.1 3d58896f901dbeed449603f5d2b4d9f1.cloudfront.net (CloudFront)
age: 8984187
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-C2
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: CRhF8QeZeAxzPDTutIvDVbaiW6Xlm0XhGz2aii1rGrE4Pp2nX3j0Lw==

GET
H2 200 portal.html Show response
admiral.mgr.consensu.org/ Frame 584F 5 KB
2 KB 45ms
17ms Document
text/html 35.190.76.239
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://admiral.mgr.consensu.org/portal.html

Requested by

Host: chickensstation.com
URL: https://chickensstation.com/v2hqou17GCghnS4NOCIPBRrPgYaaQfmkICgh_Zauab57xLxEh8fkPe9Pb-eGb9dQT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.76.239 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

239.76.190.35.bc.googleusercontent.com

Software

nginx /

Resource Hash

2977bb94c82e5fdc0c4922e57b17113c391a439a9a7065d4a87f938e82fc3be1

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

server: nginx
date: Thu, 18 Nov 2021 15:51:01 GMT
content-type: text/html
last-modified: Mon, 03 May 2021 19:38:30 GMT
vary: Accept-Encoding
x-hostname: quest
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 200 avatar32.jpg
c.disquscdn.com/uploads/forums/27/1420/ 881 B
1 KB 126ms
63ms Image
image/jpeg 2600:9000:2057:e600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/forums/27/1420/avatar32.jpg?1369615411

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:e600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d49d4380f8613d1bf4336bc6bc5706205737451218d8aa999d3d01beba95096f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 07 May 2021 08:10:09 GMT
via: 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 16875651
x-cache: Hit from cloudfront
content-length: 881
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Mon, 27 May 2013 00:43:32 GMT
server: nginx
etag: "771aee6f05be68743cb9e919449fdf49"
content-type: image/jpeg
expires: Sat, 07 May 2022 08:10:09 GMT
cache-control: max-age=31536000, public, immutable
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-amz-cf-id: 6wSz3h2G46H6PnSmZpx-OGWyHKEKwQ_tpkKoIT2uU57O_U0wwlNFoA==
x-cache-hits: 0

GET
H2 200 avatar32.jpg
c.disquscdn.com/uploads/users/37843/8901/ 811 B
1 KB 122ms
60ms Image
image/jpeg 2600:9000:2057:e600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/users/37843/8901/avatar32.jpg?1637234393

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:e600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0271a4b8219480a5ffd0b7d1bbbcbe3775b14b5e46b35d054cbe307ee49e24df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 11:38:00 GMT
via: 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 15181
x-cache: Hit from cloudfront
content-length: 811
x-xss-protection: 1; mode=block
x-served-by: static-web-1
last-modified: Thu, 18 Nov 2021 11:19:53 GMT
server: nginx
etag: "2ab482dff2b99e64da789e315ef8e644"
content-type: image/jpeg
expires: Fri, 18 Nov 2022 11:38:00 GMT
cache-control: max-age=31536000, public, immutable
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-amz-cf-id: EOorfNHwOH10jAkdN8w8Quce0OYOiPcBaOp2P4yy8kJpcXBeQJ_fXQ==
x-cache-hits: 0

GET
H2 200 avatar32.jpg
c.disquscdn.com/uploads/users/2794/8165/ 1 KB
1 KB 126ms
64ms Image
image/jpeg 2600:9000:2057:e600:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/uploads/users/2794/8165/avatar32.jpg?1370075692

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2057:e600:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

8665185ccda60f01b7e1b7b78b569ee987653a9261628fdea303bf1042cbc8c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 11:38:00 GMT
via: 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 15181
x-cache: Hit from cloudfront
content-length: 1037
x-xss-protection: 1; mode=block
x-served-by: static-web-2
last-modified: Sat, 01 Jun 2013 08:34:53 GMT
server: nginx
etag: "1781a56cfc18302813af7b29af7850cb"
content-type: image/jpeg
expires: Fri, 18 Nov 2022 11:38:00 GMT
cache-control: max-age=31536000, public, immutable
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-amz-cf-id: VxRVO_DVYs34Sr_zhqnvfLZi-ea39LT_q4X55kc6QFwNqKCesr-AaA==
x-cache-hits: 0

GET
H2 200 Ignite-2017-Microsoft-sign-300x225.jpg
www.onmsft.com/wp-content/uploads/2020/08/ 13 KB
13 KB 44ms
44ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2020/08/Ignite-2017-Microsoft-sign-300x225.jpg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

79d0a50751ad1a9537b018a92f32131b6d993728547b5f2725efdae517f5d52b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 596
cf-polished: origSize=13363
content-length: 13207
x-xss-protection: 1; mode=block
last-modified: Fri, 08 Jan 2021 18:12:22 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5ff8a086-3433"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TXtCcRN0pm2iiS9mQKFFXzV8clIqgjaLAqi4da4K%2FjBbZLhfRNWDrQTe6yo3SC9FHJKJYPSWzAwyjIuJRSaI2wnqolmKaqU5QXhGt1ljt6plgwy%2FqD3CEyHa0AtZvv0t"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b9c4c313622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 halo-infinite-battle-pass-changes-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/11/ 25 KB
26 KB 53ms
52ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/11/halo-infinite-battle-pass-changes-640x480.jpg.webp

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cbebf07816872ad458048f157448b98cb746be84e27e254115cd3603b4ee5829

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1814
content-length: 26068
x-xss-protection: 1; mode=block
last-modified: Thu, 18 Nov 2021 09:17:46 GMT
server: cloudflare
etag: "61961a3a-65d4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DptUYLAGlDdUBmb6jvFE73OLSnO2sGqQjaSFZtO19PF%2B2%2FbvmOBJT9IYauTLAoItQKmnkR0MDXZh8hFIYsaTzSmtCqGDSX5uDCSx7Gwrx7Fnk%2FVCsrspwcaFKRx7Cqh6"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
accept-ranges: bytes
cf-ray: 6b025b9c4c343622-MAN

GET
H2 200 fortnite-chapter2-finale-xbox-pc-ps5-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/11/ 23 KB
23 KB 48ms
47ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/11/fortnite-chapter2-finale-xbox-pc-ps5-640x480.jpg.webp

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

113c57ce2fcff5c63de9cd958661c4bb59385cb644f07998cf2b9a428cf1a649

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1814
content-length: 23326
x-xss-protection: 1; mode=block
last-modified: Thu, 18 Nov 2021 08:01:55 GMT
server: cloudflare
etag: "61960873-5b1e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IgBN5K2jccBjifWLaqjR5T6bK8GX5Fo%2F%2FsNzR%2F8vct%2F%2BZlxSaa2nid%2BtFG2ghoa%2BTX%2FlqIZtuDMKH0KF703Ldh0lbGO0e1bgHkIM7zPL%2FSCCFBqdT%2F%2BIeOn2yw%2B8cuvS"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
accept-ranges: bytes
cf-ray: 6b025b9c4c363622-MAN

GET
H2 200 MIcrosoft-Edge-Dev-300x225.jpg
www.onmsft.com/wp-content/uploads/2020/08/ 5 KB
5 KB 42ms
41ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2020/08/MIcrosoft-Edge-Dev-300x225.jpg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3aeb3bd5507f3536a83e52d8a8387d41dc5bc3636a99ada2405220fa6d7cc032

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 26536
cf-polished: origSize=5142
content-length: 5040
x-xss-protection: 1; mode=block
last-modified: Sat, 09 Jan 2021 16:35:13 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5ff9db41-1416"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1x6V9v5rSHzvTmJ81mABogCR707i%2Fy3YywBTN8OogE3PwSwRCvJXjOr5JsbMgO1kW6yT1lF1BQFugmSQwLfVaDOKiEeUZlkCd2sOd8zSQxpGf7wSR1sqbkx6FsEzzT%2Fz"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b9c5c393622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 Qualcomm-investors-day-2021-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/11/ 13 KB
14 KB 50ms
50ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/11/Qualcomm-investors-day-2021-640x480.jpg.webp

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c73dd814f0b64077d7585fb3e536ee7474d68af2421052b86da25969def2e48d

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1775
content-length: 13728
x-xss-protection: 1; mode=block
last-modified: Wed, 17 Nov 2021 19:56:21 GMT
server: cloudflare
etag: "61955e65-35a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7gfAaYbCl%2BLhOPIBhAa9eaMZFO%2BCXpiFv5X3MWj4a5xT0RCb7dBSwJ71tlaW9LOPqwFtHKEKJTioyktwduxIFg0HVstkY077JL5%2BbUpWF8k34CzwZQPTm3fXS7c6GjUJ"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
accept-ranges: bytes
cf-ray: 6b025b9c5c3e3622-MAN

GET
H2 200 videoseries Show response
www.youtube.com/embed/ Frame B4E6 105 KB
30 KB 148ms
107ms Document
text/html 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

37177d430f1a4457fe75814774e4eb49b5107f5eacaf93a8c7d6f64d9a04e252

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 18 Nov 2021 15:51:01 GMT
strict-transport-security: max-age=31536000
report-to: {"group":"AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"}]}
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2

200

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=8&c2=6036316&c3=1&ns__t=1637250661816&ns_c=UTF-8&cv=3.5&c8=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&c7=https%3A%2F%2Fwww.onmsft.com%...
https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&c3=1&ns__t=1637250661816&ns_c=UTF-8&cv=3.5&c8=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&c7=https%3A%2F%2Fwww.onmsft.com...

64 B
328 B

19ms
19ms

Image
image/gif

13.35.253.75
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&c3=1&ns__t=1637250661816&ns_c=UTF-8&cv=3.5&c8=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&c7=https%3A%2F%2Fwww.onmsft.com%2F&c9=
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Server: 13.35.253.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-253-75.fra6.r.cloudfront.net
Software: /
Resource Hash: 831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
via: 1.1 9bca546700a965c9c77ef5b8dbe65cc4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
etag: W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache: Miss from cloudfront
content-type: image/gif; charset=utf-8
content-length: 64
x-amz-cf-id: OO_NebBAoYN7ZkFnfDcUcnaC2bHa_DLQ0O8pbMg1Uj5sXhQa1W_cmg==

Redirect headers

date: Thu, 18 Nov 2021 15:51:01 GMT
via: 1.1 9bca546700a965c9c77ef5b8dbe65cc4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
vary: Accept
x-cache: Miss from cloudfront
content-type: text/plain; charset=utf-8
location: https://sb.scorecardresearch.com/b2?c1=8&c2=6036316&c3=1&ns__t=1637250661816&ns_c=UTF-8&cv=3.5&c8=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&c7=https%3A%2F%2Fwww.onmsft.com%2F&c9=
content-length: 226
x-amz-cf-id: fJUcmgGZ6q_lTfnEEk12fzPFRfKUc6SdRX9qCO9MBgOOrhluFcv7TA==

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 200 B
405 B 16ms
15ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.onmsft.com&callback=_gfp_s_&client=ca-pub-1197011367764122

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202111110101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-1197011367764122&plah=www.onmsft.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

3d54932c098ba6088e2c2ca78b976bb2668542c4bc8902c3cd0ea150ba9d6278

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 190
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 47ms
18ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.onmsft.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 46ms
17ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.onmsft.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame B471 0
165 B 69ms
67ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?us_privacy=1---&client=ca-pub-1197011367764122&output=html&adk=1812271804&adf=3025194257&lmt=1637249397&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.onmsft.com%2F&ea=0&flash=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&dt=1637250661550&bpp=3&bdt=645&idt=289&shv=r20211111&mjsv=m202111110101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=7560448573203&frm=20&pv=2&ga_vid=1565518977.1637250662&ga_sid=1637250662&ga_hid=678711843&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44753740&oid=2&pvsid=370371658239117&pem=687&tmod=1454011181&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=308

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 18 Nov 2021 15:51:01 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 18 Nov 2021 15:51:01 GMT
cache-control: private

GET
H2 200 pub Show response
pixel.adsafeprotected.com/services/ 1 KB
2 KB 122ms
42ms XHR
application/json 34.254.9.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/services/pub?anId=7529&slot=%7Bid:nsgpt-billboard-1,ss:%5B728.90,997.123,970.250,970.180,970.90%5D,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-largerectangle-1,ss:%5B336.280,300.250%5D,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-halfpage-1,ss:%5B300.600,300.250%5D,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-footer-1,ss:%5B970.90,728.90,997.123%5D,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-footer,s:1.1,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-stitials,s:1.1,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-inpage,s:1.1,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-skin,s:1.1,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-inline,s:1.1,p:/4585/ns.onmsft/homepage,t:display%7D&slot=%7Bid:nsgpt-oop-masthead,s:1.1,p:/4585/ns.onmsft/homepage,t:display%7D&wr=1600.1200&sr=1600.1200&sessionId=106ffc07-a18c-d604-5a44-ec8235754a99&url=https%253A%252F%252Fwww.onmsft.com%252F
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.9.67 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-9-67.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 2538a0fba24a9c5fdc455e3978601c55be5601afd25dc1025446ec5a075fc61f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
x-server-name: app11.ie.303net.net
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.onmsft.com
access-control-expose-headers: X-Server-Name
access-control-allow-credentials: true
timing-allow-origin: *
server: nginx

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
438 B 62ms
20ms XHR
text/plain 2a00:1450:400c:c07::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-71939551-1&cid=1565518977.1637250662&jid=1664039620&gjid=286173394&_gid=1686212034.1637250662&_u=YEDAAEABAAAAAC~&z=1436562254

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c07::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 18 Nov 2021 15:51:01 GMT
content-type: text/plain
access-control-allow-origin: https://www.onmsft.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clarity.js Show response
g.clarity.ms/s/0.6.28/ 52 KB
22 KB 427ms
128ms Script
application/javascript 52.182.214.99
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.clarity.ms/s/0.6.28/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/3vjoryfbqq
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.182.214.99 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: f2640f97f4f4fabc63971ceed2b746be5dfb197bba340759a70636ce13cb59e7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: br
etag: "1d7dc061cb1dd2d"
last-modified: Wed, 17 Nov 2021 22:54:44 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:7f62cbe7-9d8b-4a41-a628-fbaa3aa5c695

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=685788D2387A455B85B426CB12888347&RedC=c.clarity.ms&MXFR=053A321C468B6C60170122EF428B62EC
https://c.clarity.ms/c.gif?CtsSyncId=685788D2387A455B85B426CB12888347&MUID=0680AB0BAA09668E2626BBF8AB626797

42 B
368 B

44ms
43ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=685788D2387A455B85B426CB12888347&MUID=0680AB0BAA09668E2626BBF8AB626797
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:01 GMT
last-modified: Fri, 05 Nov 2021 17:19:23 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "f95a3e4769d2d71:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:01 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8688681A21014CEB8D2D83A9B692E79E Ref B: FRAEDGE1412 Ref C: 2021-11-18T15:51:02Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=685788D2387A455B85B426CB12888347&MUID=0680AB0BAA09668E2626BBF8AB626797
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H2 200 info Show response
gurgle.zdbb.net/ 818 B
1 KB 164ms
164ms XHR
application/json 34.228.209.86
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://gurgle.zdbb.net/info?url=https%3A%2F%2Fwww.onmsft.com%2F&fp=0
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.228.209.86 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-228-209-86.compute-1.amazonaws.com
Software: /
Resource Hash: 4b7e671011de15bd25ed5d647d924227c6d77d4f6796c1e43ba42fd3f2d7db54

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: https://www.onmsft.com
date: Thu, 18 Nov 2021 15:51:02 GMT
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control
content-length: 818
access-control-allow-methods: GET, OPTIONS
content-type: application/json

GET
H/1.1 200
OK widget_iframe.a53eecb4584348a2ad32ec2ae21f6eae.html Show response
platform.twitter.com/widgets/ Frame 86D6 319 KB
103 KB 41ms
40ms Document
text/html 2606:2800:234:59:254c:406:2366:268c
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.a53eecb4584348a2ad32ec2ae21f6eae.html?origin=https%3A%2F%2Fwww.onmsft.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (mil/6CE7) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 58975
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Thu, 18 Nov 2021 15:51:01 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Mon, 18 Oct 2021 18:32:00 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (mil/6CE7)
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105433

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
490 B 77ms
77ms XHR
text/javascript 13.32.21.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.amazon-adsystem.com/e/dtb/bid?src=3916&u=https%3A%2F%2Fwww.onmsft.com%2F&pid=uEudtcRvuCdYd&cb=0&ws=1600x1200&v=7.71.1&t=800&slots=%5B%7B%22sd%22%3A%22nsgpt-billboard-1%22%2C%22s%22%3A%5B%22728x90%22%2C%22997x123%22%2C%22970x250%22%2C%22970x180%22%2C%22970x90%22%5D%2C%22sn%22%3A%22billboard%22%7D%2C%7B%22sd%22%3A%22nsgpt-largerectangle-1%22%2C%22s%22%3A%5B%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22largerectangle%22%7D%2C%7B%22sd%22%3A%22nsgpt-halfpage-1%22%2C%22s%22%3A%5B%22300x600%22%2C%22300x250%22%5D%2C%22sn%22%3A%22halfpage%22%7D%2C%7B%22sd%22%3A%22nsgpt-footer-1%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%2C%22997x123%22%5D%2C%22sn%22%3A%22footer%22%7D%5D&gdprl=%7B%22status%22%3A%22cmp-timeout%22%7D

Requested by

Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.21.201 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-21-201.fra56.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
via: 1.1 0d5d2d408eb42296c7636196e25ef8a3.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-C2
x-amz-rid: E6WAWFVWAP9EY5MK52M1
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.onmsft.com
access-control-allow-credentials: true
permissions-policy: interest-cohort=()
strict-transport-security: max-age=47474747; includeSubDomains; preload
timing-allow-origin: *
content-length: 23
x-amz-cf-id: bqIamz4Swh97RfK2wbW48Iq8-2zZ122afWswfwP_LiypEY5pSrydWg==

GET
H2 200 windows-11-laptop-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/10/ 17 KB
17 KB 53ms
53ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/10/windows-11-laptop-640x480.jpg.webp

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0b657941d77683754e93d7c317fbaf8f3ac530caa74b312548ca7b9384d8795

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1811
content-length: 17044
x-xss-protection: 1; mode=block
last-modified: Thu, 21 Oct 2021 09:40:59 GMT
server: cloudflare
etag: "617135ab-4294"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BPeI%2BwgEo%2FxfPMuUHg0wVcM9dLPuYnAVIwKo53snRcUJ39hiUdVG%2Bnq3jFFv25HulQKZTRpA7npcSTNc1fTdWZymGqdQP%2FSARa5O6qF1CI1zjvla8S8corRybES8jg4P"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
accept-ranges: bytes
cf-ray: 6b025b9d7e623622-MAN

GET
H2 200 www-player-webp.css
www.youtube.com/s/player/68e11abe/ Frame B4E6 335 KB
46 KB 8ms
7ms Stylesheet
text/css 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/68e11abe/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bf0536a7ccecbfef8793cfc6a61b4454864a4197992ce5ddaa014b48f72bef9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:37:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87183
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47155
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 01:16:56 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 17 Nov 2022 15:37:58 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame B4E6 15 KB
15 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 17:06:41 GMT
x-content-type-options: nosniff
age: 168260
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 16 Nov 2022 17:06:41 GMT

GET
H2 200 www-embed-player.js Show response
www.youtube.com/s/player/68e11abe/www-embed-player.vflset/ Frame B4E6 209 KB
69 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/68e11abe/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

29be43ca0b70c4e225ada478f84eb07291171636c30c57b249fb7d26b7a09ae2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 13:06:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 9876
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 70113
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 01:16:56 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 18 Nov 2022 13:06:25 GMT

GET
H2 200 base.js Show response
www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/ Frame B4E6 2 MB
520 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9384d1dd440619b40a97f2b756f3e1b9336efce2c87977001f49d81d1556b81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:37:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87183
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 531666
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 01:16:56 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 17 Nov 2022 15:37:58 GMT

GET
H2 200 fetch-polyfill.js Show response
www.youtube.com/s/player/68e11abe/fetch-polyfill.vflset/ Frame B4E6 8 KB
3 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/68e11abe/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:39:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 698
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2830
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 01:16:56 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 18 Nov 2022 15:39:24 GMT

GET
H2

200

/ Show response
www.onmsft.com/
Redirect Chain

https://www.onmsft.com/.well-known/pubvendors.json
https://www.onmsft.com/

157 KB
26 KB

644ms
644ms

Fetch
text/html

104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af8bf24084056feb9721b81b30360895b9c907a88a391f2eec8701eeeb3db506

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: BYPASS
last-modified: Thu, 18 Nov 2021 15:29:57 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JDB0mexd8qQu%2Btbx9UgHhZJlMFnOjKVh%2FmQTRQhxdffJHrmu15ibeT9ZMPmfQGKKoaXP2y%2Fwx2gM8tasJi13Md3EY05LQBN9cJFpFdJWSuIm%2BYjRskOQhxh%2B%2ByV%2FO8KA"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-apo-via: origin,page-rules
cf-ray: 6b025ba16ef53622-MAN
x-xss-protection: 1; mode=block

Redirect headers

date: Thu, 18 Nov 2021 15:51:02 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-redirect-by: Rank Math
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CL%2FII2Ukrx%2BLCI1jybnF97t1BEpY8v1fphkudICIT%2FjCQH0%2BxcEFeMAHXUyQiSqEgr13urHnCsLCYC7rig5LlNv1%2B6TPBQmFi6eNyCxQg%2BT%2BKfOGgQjpwi5DdDwRJYvb"}],"group":"cf-nel","max_age":604800}
content-type: text/html; charset=UTF-8
location: https://www.onmsft.com
cache-control: no-cache, must-revalidate, max-age=0
cf-apo-via: origin,no-cache
cf-ray: 6b025b9d9ece3622-MAN
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 86D6 232 B
448 B 221ms
187ms Fetch
application/json 104.244.42.72
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=c815ea0a23672656c012bbb306dfdd0e5c7df26a

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.a53eecb4584348a2ad32ec2ae21f6eae.html?origin=https%3A%2F%2Fwww.onmsft.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.72 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-response-time: 168
date: Thu, 18 Nov 2021 15:51:01 GMT
content-encoding: gzip
last-modified: Thu, 18 Nov 2021 15:51:02 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: 60cfacef762beb037d89c9709f3db1b60ebb23dbb8ac339550e9df9c20ee452c
content-length: 166

GET
H2 200 z0WVjCBSEeGLoxIxOQVEwQ
zdbb.net/l/ 43 B
109 B 151ms
44ms Image
image/gif 52.215.85.116
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://zdbb.net/l/z0WVjCBSEeGLoxIxOQVEwQ?additionalInformation=&cms_page_id=&local_uid=&referrer=&zd_pageview_id=fe27d47e-5003-44f1-a6cc-eb28d63306f6&zd_location=https%3A%2F%2Fwww.onmsft.com%2F&evidon_consent=undefined&third_party_consent=&fu=true
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.85.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-85-116.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
content-length: 43
content-type: image/gif

GET
H2

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame B4E6
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

100 B
216 B

52ms
52ms

XHR
application/json

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Protocol

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a5dd1df6b0ecab77f115a119e53f0100f0440faf7d83cd687da29b659555e497

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 18 Nov 2021 15:51:02 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame B4E6 29 B
588 B 102ms
28ms Script
text/javascript 2a00:1450:4001:803::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/68e11abe/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:42:28 GMT
x-content-type-options: nosniff
age: 514
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 18 Nov 2021 15:57:28 GMT

GET
H2 200 remote.js Show response
www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/ Frame B4E6 94 KB
29 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77af01d79cf3cd7c3abd4efc08dd7d75d8c2d07ce3861a27eb9016eefe68cac3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:38:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87181
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29838
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 01:16:56 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 17 Nov 2022 15:38:01 GMT

GET
H2 200 axIybeQdxw4RbI0uaxpPXcBGoAQIrvp7kySsSJR_Uaw.js Show response
www.google.com/js/th/ Frame B4E6 35 KB
14 KB 85ms
22ms Script
text/javascript 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/axIybeQdxw4RbI0uaxpPXcBGoAQIrvp7kySsSJR_Uaw.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b12326de41dc70e116c8d2e6b1a4f5dc046a00408aefa7b9324ac48947f51ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 23:15:05 GMT
content-encoding: br
x-content-type-options: nosniff
age: 59757
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13308
x-xss-protection: 0
last-modified: Fri, 12 Nov 2021 10:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 17 Nov 2022 23:15:05 GMT

GET
H2 200 embed.js Show response
www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/ Frame B4E6 24 KB
7 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c824c03e1cef40b4875f33a8584f82475c493ca230ad27d84463ffcc755b005e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:38:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 87181
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7357
x-xss-protection: 0
last-modified: Wed, 17 Nov 2021 01:16:56 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 17 Nov 2022 15:38:01 GMT

GET
DATA 200
OK truncated
/ Frame B4E6 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 AKedOLRvctfx406YRVIYqdRSbUZp_xc770u72DDmSMviKmE=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame B4E6 3 KB
3 KB 95ms
8ms Image
image/jpeg 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/AKedOLRvctfx406YRVIYqdRSbUZp_xc770u72DDmSMviKmE=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b8d36873e116f6537f2ba71fc43dea922cdc1f70a77aa2674283c1c51509ff1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 12:37:21 GMT
x-content-type-options: nosniff
age: 11621
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2916
x-xss-protection: 0
server: fife
etag: "v1d1b1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 13 Nov 2021 13:16:25 GMT

GET
H2 200 sddefault.jpg
i.ytimg.com/vi/iGzrJBmuy8M/ Frame B4E6 39 KB
40 KB 94ms
9ms Image
image/jpeg 2a00:1450:4001:829::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/iGzrJBmuy8M/sddefault.jpg

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e8da7b6eb5213262640cb4544153080dbdf31dda26948a97c135b298eb8829d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 14:42:55 GMT
x-content-type-options: nosniff
age: 4087
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40331
x-xss-protection: 0
server: sffe
etag: "1636807401"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=7200
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 18 Nov 2021 16:42:55 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame B4E6 4 KB
3 KB 65ms
15ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/68e11abe/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 18 Nov 2021 15:51:02 GMT

GET
H2 200 248538-featured-315x165.jpg
www.onmsft.com/wp-content/uploads/wordpress-popular-posts/ 7 KB
8 KB 42ms
39ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/wordpress-popular-posts/248538-featured-315x165.jpg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

32d527616568560a722b8ff8ebd45a45769282cf230d51be032d3be707527795

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 83482
cf-polished: origSize=8025
content-length: 7529
x-xss-protection: 1; mode=block
last-modified: Wed, 17 Nov 2021 16:32:39 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61952ea7-1f59"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n1hLv4H39f6UDMZ3zp1lbKErTGHlaljbEONjob5%2FrP3AO48qB7aieiY%2F8lq8HUNrmy9drfM%2BMv56WJlyBGCDkXIfgCZpwvNSTQD7LDkQD22zrYlFT93bf64VdG4BdcRI"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b9f6b4a3622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 248416-featured-315x165.jpg
www.onmsft.com/wp-content/uploads/wordpress-popular-posts/ 16 KB
16 KB 47ms
44ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/wordpress-popular-posts/248416-featured-315x165.jpg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

077cbc5475d39fca27354bf7d16c9de766acba969edae830c856e152f07f846a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 149089
cf-polished: origSize=17048
content-length: 15949
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Nov 2021 22:21:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61942efa-4298"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SkeXY4MBLXfuk5mUYahQUK1Et6HdNLdDx2URqUiizAfy4n8%2Fm2xQiFad2%2BLstFljFy2w70vhOVfbaXkJ%2B%2B%2BkeV2lIxHTB20Ezl3IZ4f8IqMAWBdyXGDoWGolBW9LkKRc"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b9f6b4d3622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 248265-featured-315x165.jpg
www.onmsft.com/wp-content/uploads/wordpress-popular-posts/ 12 KB
13 KB 39ms
37ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/wordpress-popular-posts/248265-featured-315x165.jpg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f34eb36d55671917a126b11b2d7a6f67c84a56567e2a42ef35a4ce18c7936da0

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 484103
cf-polished: origSize=13423
content-length: 12641
x-xss-protection: 1; mode=block
last-modified: Sat, 13 Nov 2021 01:20:43 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "618f12eb-346f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VGT8np3Czwu4Ap2COrO66UkP2f%2Fshxm4rLTwn%2Fk%2Fz8%2F01oYTKsJA4rWxqTel5bdXqnQC8iiSjsCzLQRv5iVXEcmXuQ8J0DCcTUTk9dpjKiYjSxOT6uEKTarF0Ftj3ij5"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b9f6b4e3622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 248332-featured-315x165.jpg
www.onmsft.com/wp-content/uploads/wordpress-popular-posts/ 9 KB
10 KB 35ms
33ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/wordpress-popular-posts/248332-featured-315x165.jpg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f9c6e32ff834ad3b6069f9bc17ec6c678eeaca93a167d7d76acc1c1530d514b8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 255628
cf-polished: origSize=9984
content-length: 9211
x-xss-protection: 1; mode=block
last-modified: Mon, 15 Nov 2021 16:29:17 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "61928add-2700"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6Y1%2Fb4meCXydOJpVH6GxDF4xr4CDgZnNSmNvEj%2F7aT9ZTj85KpEMsMF3gg9YF%2B5nHpZt75JQwPSYNXuUaUr2kz4eAN59ZP1yujX4PLZkmLBmLmhpnv1DRqSgIbIFEn00"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b9f6b513622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 248394-featured-315x165.jpg
www.onmsft.com/wp-content/uploads/wordpress-popular-posts/ 14 KB
14 KB 53ms
51ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/wordpress-popular-posts/248394-featured-315x165.jpg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d8685d9f00e3e1bbd661e6e8f170759462bec4dade694ebf6dab636316fb970b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 159362
cf-polished: origSize=15320
content-length: 14315
x-xss-protection: 1; mode=block
last-modified: Tue, 16 Nov 2021 19:21:46 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "619404ca-3bd8"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=c74yULJDC9mDe6NVASfgGrSyfcitiIcQ93z9oSuA8%2FuMy1hrfCLFQpq6dRcHUy2RWWMu3E5UY6xJyV45yCj7WNvvh3yZVQuBULYoJ%2F%2B7eBIMBajWZNk2o37JOizFZ7kr"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b9f6b523622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 248277-featured-315x165.jpg
www.onmsft.com/wp-content/uploads/wordpress-popular-posts/ 9 KB
9 KB 36ms
35ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/wordpress-popular-posts/248277-featured-315x165.jpg

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5c5c45a24816f8401f7c6b6636addab51fe390c9edc40116c8ddd8dd8e80fffd

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 472494
cf-polished: origSize=9619
content-length: 8837
x-xss-protection: 1; mode=block
last-modified: Sat, 13 Nov 2021 04:20:43 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "618f3d1b-2593"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Bnx%2FDrEeedpu2s7yU9T2J0tybkGIbG23W%2FaOyMZTtjW2FZ7lmqOLTIgL8HgdloNlZQ1WSlltNe71QbGG0PT9mgEW2vbytuHYFombVIDd3IsECDuIaD0AOcP6POmGR9Rz"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025b9f6b543622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 204 generate_204
www.youtube.com/ Frame B4E6 0
39 B 9ms
7ms Image
text/plain 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?Ni3nbw
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/95/ Frame B4E6 52 KB
15 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/95/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9ca9fbe90c932d2954e1c8cb18dea47e37035aea6157e8e10a97e70f09402fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 14:49:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3703
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15249
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 23:31:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="cloudview-release"
expires: Fri, 19 Nov 2021 14:49:19 GMT

GET
H2 200 match Show response
bee.imrworldwide.com/v1/clients/ 39 B
505 B 53ms
14ms XHR
application/json 143.204.215.5
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://bee.imrworldwide.com/v1/clients/match?client_id=ziffdavis&url=https://www.onmsft.com/

Requested by

Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.215.5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-215-5.fra53.r.cloudfront.net

Software

Resource Hash

0210bcf8c6f9fb41e1db722e8ec3c318101342f5922c59331321c993df1720d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=25920000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 12:06:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13452
x-cache: Hit from cloudfront
vary: Accept-Encoding
content-length: 63
x-xss-protection: 1; mode=block
access-control-allow-origin: *
x-frame-options: DENY
strict-transport-security: max-age=25920000; includeSubDomains
content-type: application/json; charset=utf-8
via: 1.1 ab39b007ab81966ada6e7fb1536bf377.cloudfront.net (CloudFront)
access-control-allow-credentials: true
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: CNj26qS3V6KeKJIAzdZxSea7BHmoyFaqZdihBdKt-lzQpPKWpZnoUg==

GET
H2 200 storageframe.html Show response
secure-us.imrworldwide.com/ Frame 5813 11 KB
4 KB 32ms
32ms Document
text/html 99.80.67.55
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure-us.imrworldwide.com/storageframe.html
Requested by: Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.67.55 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-67-55.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c6107c1c1f1588cac73cb68d83222515b12c5dbf7f988fd0c39b4ff16414d3bc

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
content-type: text/html
content-length: 3489
server: nginx
last-modified: Tue, 02 Nov 2021 17:34:35 GMT
etag: "618176ab-da1"
content-encoding: gzip
access-control-allow-origin: *
access-control-allow-methods: POST, OPTIONS
cross-origin-resource-policy: cross-origin

GET
H2 200 config250.js Show response
cdn-gl.imrworldwide.com/conf/ 12 KB
5 KB 16ms
16ms Script
application/javascript 2600:9000:214f:5a00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/conf/config250.js
Requested by: Host: secure-us.imrworldwide.com
URL: https://secure-us.imrworldwide.com/v60.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:5a00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 58d221914c062c193f1658291cca5d00d1763feabb3ccc789891281068514019

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: BSWUw9QkM1POY38mvPaJTYtj4yhE3Zke
content-encoding: gzip
etag: W/"8db9b3d29127be5ae66e7a139c04e9c8"
last-modified: Thu, 18 Nov 2021 13:21:11 GMT
server: AmazonS3
age: 2211
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront)
cache-control: max-age=86400,s-maxage=86400
date: Thu, 18 Nov 2021 15:14:13 GMT
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: Ei-3X8BI23gKCDYd3KO8WTKf-Bs2hJQ0AHwBCPcLJLzmZEr6BN7atQ==

GET
H2 200 m
secure-us.imrworldwide.com/cgi-bin/ 44 B
368 B 39ms
38ms Image
image/gif 99.80.67.55
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/m?rnd=1637250662532&ci=ziffdavis&js=1&cg=0&ts=v2?ol=0&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~tM!90vv9L%24%2FoDb%2FG)lKr%23l9jmUdTfN%5Bqir1fcSC%3AU%3FWOvTh%7CzFK%3F%5B%22l!j%3F%5DV%22%3BU!%2FBwj%5DUG0U20!9%3Am%5EG..%2C*%5D%407%25rxaxcpaO%2BZ%5EhG%22%3ExZq%224%7CQjw%60.%7Bi%3F%5DQZ%2CA2%2BNhloI%40s1%7CZ5*%3FVl%3Fe3%7CqL5%40J%3D%5B*EjrG%3DH%3CA.a%24%7D9H%3BatASYUby%3D(tN%23V.x%3Bm_Qrw5.W%2F84VKp%40i6AKx!f%3EUYoo813_xB%2CN22Ib%40aFB&tf=1_nMzjG---CSa7H-1SJH-bW7qhB-LRwqH-nMzjG-&vi=111111&rc=1%2C1%2C0%2C3%2C3326192205%2C1%2C4%2C0%2Cprobably%2Cprobably&rb=1-f9sEUFJ0XDIlaX11F1NpvhT%2BFty8ZWS4aztFOewYCG7c8eOm5Kk0%2FX%2FtDJ5WspFf7egP&rs=1-glpGhov6BziEcg%3D%3D&sc=1&os=1-8g%3D%3D&qp=10000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oD~T_Gr1%3E%3AB%40NVt7%3BY%3EhyMmxNXJZPV8t6%3D%3Dh_GW3r4Aj!L%3E%2BbK0pH%23H&qr=0&url=https%3A%2F%2Fwww.onmsft.com%2F&pcode=playwireprebidheader597261727146&rx=404614941320&callback=MoatNadoAllJsonpRequest_78904762&vn=6.0.104&cc=1&cd=24&ck=y&je=n&lg=en-US&si=https%3A%2F%2Fwww.onmsft.com%2F&sr=1600x1200&id=lstrg-a8a57d54c5f0f319935ba882b8827590
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.67.55 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-67-55.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:02 GMT
server: nginx
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 nlsSDK600.bundle.min.js Show response
cdn-gl.imrworldwide.com/novms/js/2/ 193 KB
54 KB 14ms
12ms Script
application/javascript 2600:9000:214f:5a00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/conf/config250.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:5a00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 28b11959f68db701b4218a36e9a8e8daf47fbfe4057f086595ebc2b0df44fbea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: zlYBAKd4EFa8SaOhPOy.ffYFxOn9YL7u
content-encoding: gzip
etag: W/"711241d99f4dbd99c7bef0f79ce85582"
last-modified: Mon, 15 Nov 2021 15:07:58 GMT
server: AmazonS3
age: 2569
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront)
cache-control: max-age=86400
date: Thu, 18 Nov 2021 15:08:14 GMT
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: bBxcTLQrIWGQZq-Ne-jQ5PllXF72vSUK9Nt5YOr-5e-sMZVt_kJHxA==

POST
H2 204 collect Show response
g.clarity.ms/ 0
69 B 274ms
274ms XHR
text/plain 52.182.214.99
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.clarity.ms/collect
Requested by: Host: g.clarity.ms
URL: https://g.clarity.ms/s/0.6.28/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.182.214.99 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: https://www.onmsft.com
date: Thu, 18 Nov 2021 15:51:01 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:7f62cbe7-9d8b-4a41-a628-fbaa3aa5c695

GET
H2 200 ls.html Show response
cdn-gl.imrworldwide.com/novms/html/ Frame 3AEB 12 KB
4 KB 9ms
8ms Document
text/html 2600:9000:214f:5a00:2:42d9:3100:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-gl.imrworldwide.com/novms/html/ls.html
Requested by: Host: cdn-gl.imrworldwide.com
URL: https://cdn-gl.imrworldwide.com/novms/js/2/nlsSDK600.bundle.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:5a00:2:42d9:3100:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c1ca15aa8598ac972f25c8812a1c189cd22f8926ec7b890bc8ea6a70a7779fd1

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

content-type: text/html
last-modified: Mon, 18 Oct 2021 14:09:23 GMT
x-amz-server-side-encryption: AES256
x-amz-version-id: fWy1EzHp9Q0L9DPiegymkYQaHVC9sb1R
server: AmazonS3
content-encoding: gzip
date: Thu, 18 Nov 2021 15:07:23 GMT
cache-control: max-age=86400
etag: W/"7fa83dfc7b78314b137e2eb13834daa7"
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA53-C1
x-amz-cf-id: cc3Yv0ugkMnDAB8cs6CIPZT7zvemebQ8Cxr5PBu_JSNTOWI7Xrd_RQ==
age: 6194

GET
H2 200 check Show response
jogger.zdbb.net/ 5 B
231 B 326ms
102ms XHR
text/plain 34.228.50.94
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://jogger.zdbb.net/check?href=https%3A%2F%2Fwww.onmsft.com%2F
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.228.50.94 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-228-50-94.compute-1.amazonaws.com
Software: /
Resource Hash: 4e523a5ae5b4636c75901b79fafbd3912e41dc7987414e688b09d4b436ff22b3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
access-control-allow-methods: GET, OPTIONS
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=848322
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Cache-Control
content-length: 5

GET
H2 200 zd-core-olt.min.js Show response
cdn.static.zdbb.net/js/ 844 B
1 KB 23ms
23ms Script
application/javascript 2.16.186.144
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.zdbb.net/js/zd-core-olt.min.js?v=5
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.144 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-144.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 1331ce07d67579b7a85c3f1deb9479460b198356c6d1aee8de72daa1d5e377b2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: m9qYSzJJg2BUi8jajQqGDmdV8RmdM5tr
last-modified: Tue, 09 Nov 2021 14:08:07 GMT
x-amz-request-id: 4THHY6QN3WFB96DE
date: Thu, 18 Nov 2021 15:51:02 GMT
content-type: application/javascript
cache-control: max-age=604800
accept-ranges: bytes
content-length: 844
x-amz-id-2: KtE0CFGRuVbvn3wttnhEhQm00gEsKyr1hXXW0IB2yL6Xd1qozeyUHQA30gHY3OzzRVzVVy06vWo=
expires: Thu, 25 Nov 2021 15:51:02 GMT

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 51 KB
16 KB 105ms
34ms Script
application/javascript 104.111.228.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.228.137 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-137.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip
Last-Modified: Fri, 21 May 2021 19:14:21 GMT
Server: nginx/1.15.8
ETag: W/"60a8068d-cbc2"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=604800
Date: Thu, 18 Nov 2021 15:51:02 GMT
Connection: keep-alive
Content-Length: 16078
Expires: Thu, 25 Nov 2021 15:51:02 GMT

GET
H2 200 krux-coretag.js Show response
cdn.static.zdbb.net/js/ 335 B
627 B 23ms
23ms Script
application/javascript 2.16.186.144
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.static.zdbb.net/js/krux-coretag.js
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.16.186.144 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-144.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4f30bdeed794aeb92d85e55d901c0bdb634df32432010792e3b569ea73cae443

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-amz-version-id: KF7Dyr28L20EMaFT2Or6AtrMV8uapOh6
last-modified: Tue, 09 Nov 2021 14:08:06 GMT
x-amz-request-id: 4THNHRK7V7D6AD2K
date: Thu, 18 Nov 2021 15:51:02 GMT
content-type: application/javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 335
x-amz-id-2: kWgWqyBSBFY4teeQwpKmEjJe00iwSH/hNP6cClW6ryjTP2Oexg7uI7spIAwS5rpYXT64MOwjYng=
expires: Fri, 19 Nov 2021 15:51:02 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 12 KB
10 KB 47ms
22ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20211111&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

485a81bab58dffc36cba3d721a7d1fc7dad48bd8b24563e399b8d01cbdbed611

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9295
x-xss-protection: 0

POST
H2 200 rum Show response
www.onmsft.com/cdn-cgi/ 0
241 B 49ms
49ms XHR
text/plain 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://www.onmsft.com/cdn-cgi/rum?

Requested by

Host: static.cloudflareinsights.com
URL: https://static.cloudflareinsights.com/beacon.min.js/v64f9daad31f64f81be21cbef6184a5e31634941392597

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
content-type: application/json

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cloudflare
x-frame-options: DENY
access-control-allow-methods: POST,OPTIONS
content-type: text/plain
access-control-allow-origin: https://www.onmsft.com
access-control-max-age: 86400
access-control-allow-credentials: true
cf-ray: 6b025ba19f3d3622-MAN
vary: Origin

GET
H2 200 gn
secure-us.imrworldwide.com/cgi-bin/ Frame 3AEB 88 B
604 B 34ms
34ms Image
image/gif 99.80.67.55
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/gn?prd=session&c9=devid,&c13=asid,NA&sessionId=ih8i01rvpi9ilkttxeflyi70hutup1637250662&c16=sdkv,bj.6.0.0&retry=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.67.55 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-67-55.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 18344242ff477e6698f24b0211d53b9194cef9905ad67c8649e8a41ce614b415

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn-gl.imrworldwide.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:02 GMT
server: nginx
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-type: image/gif
content-length: 88
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 /
ih8i01rvpi9ilkttxeflyi70hutup1637250662.nuid.imrworldwide.com/ Frame 3AEB 35 B
348 B 53ms
9ms Image
image/gif 2600:9000:2057:d000:1d:667e:2a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ih8i01rvpi9ilkttxeflyi70hutup1637250662.nuid.imrworldwide.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:d000:1d:667e:2a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://cdn-gl.imrworldwide.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 01:32:35 GMT
via: 1.1 a0a81637cc76d6981e4e29044a73b7f6.cloudfront.net (CloudFront)
last-modified: Tue, 11 Sep 2018 17:05:20 GMT
server: AmazonS3
age: 51521
etag: "c2196de8ba412c60c22ab491af7b1409"
x-cache: Hit from cloudfront
content-type: image/gif
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
content-length: 35
x-amz-cf-id: eo6svG0xPY5-WkxITC9PcEjTp2niO5dbz1D9nC6t4HY26LrKYNtpTQ==

GET
H2 200 spgdj7g8u.js Show response
cdn.krxd.net/controltag/ 2 B
394 B 44ms
8ms Script
text/javascript 151.101.66.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/spgdj7g8u.js
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/krux-coretag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.66.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Thu, 18 Nov 2021 15:51:02 GMT
via: 1.1 varnish, 1.1 varnish
age: 599
x-cache: MISS, HIT, HIT
x-app-cache: MISS
x-age: 0
content-encoding: gzip
content-length: 22
x-served-by: config-service-a005-ash-prod.krxd.net, cache-bwi5180-BWI, cache-hhn4042-HHN
x-response-time: 0
x-do-esi: esi
x-timer: S1637250663.694777,VS0,VE0
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 4, 111

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 49ms
20ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 18 Nov 2021 15:51:02 GMT

GET
H2 200 Windows-11-PC-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/10/ 7 KB
7 KB 489ms
488ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/10/Windows-11-PC-640x480.jpg.webp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b95136fff5ac2d034bff45ea612eb8b014703a6537d2571a9858c51cad245ba9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
cf-cache-status: REVALIDATED
last-modified: Mon, 04 Oct 2021 20:57:53 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "615b6ad1-1c30"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GduPrdhkqenUPLJZKpFzQClDl9Plsk8%2B9Z%2Fb7azvInUWCoz18Nuc5NT7pOuDov7baqZErtBiiLDIuFpKf35kD8ItUlpSVa00J5jYai8GBj4m2q6CSltsRhTcV7SrGk3f"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 6b025ba1effb3622-MAN
content-length: 7216
x-xss-protection: 1; mode=block

GET
H2 200 Xbox-Series-X-S-2-300x225.jpg
www.onmsft.com/wp-content/uploads/2020/09/ 7 KB
8 KB 46ms
45ms Image
image/jpeg 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2020/09/Xbox-Series-X-S-2-300x225.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

924dbe12660fa25d89977aaddceae50c097be41b7c0d75ec5033ec77ffd956e9

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 76740
cf-polished: origSize=7474
content-length: 7309
x-xss-protection: 1; mode=block
last-modified: Fri, 08 Jan 2021 18:08:11 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
etag: "5ff89f8b-1d32"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xznh3nwEynGh7iPdl3prsDgVTsoRBFPubMzOT5lrLCB1v1pAhpFQ0L2QgkTg1WBPynmCiKKclvvGJs31PqObO1ABWlQkJ6DAWxZndPz%2BrpdtFwjPArDv2VzkDwkoPjpJ"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
expires: Thu, 31 Dec 2037 23:55:55 GMT
cache-control: max-age=315360000
accept-ranges: bytes
cf-ray: 6b025ba1fffc3622-MAN
cf-bgj: imgq:100,h2pri

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 153D 12 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Thu, 18 Nov 2021 15:25:43 GMT
expires: Fri, 18 Nov 2022 15:25:43 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1519
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 059E 783 B
960 B 18ms
17ms Document
text/html 2a00:1450:4001:829::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

eab9caf2a800fcb29b7b57b6fa4c87f9c98d1b53bfd1f079e8d4db48f1728241

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-a8hVWitmFgIGtPxzwa+AeQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 18 Nov 2021 15:51:02 GMT
date: Thu, 18 Nov 2021 15:51:02 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-a8hVWitmFgIGtPxzwa+AeQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK 30629 Show response
stags.bluekai.com/site/ Frame BF73 71 B
337 B 239ms
167ms Document
text/html 104.111.215.191
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/30629?ret=html&phint=site%3Donmsft.com&phint=referer%3Dhttps%3A%2F%2Fwww.onmsft.com%2F&phint=bbseg%3D900099&phint=bbseg%3D900102&phint=bbseg%3D900103&phint=bbseg%3D900109&phint=bbseg%3D900110&phint=bbseg%3D900111&phint=bbseg%3D900113&phint=bbseg%3D900114&phint=bbseg%3D900115&phint=bbseg%3D900136&phint=bbseg%3D900151&phint=bbseg%3D900152&phint=bbseg%3D900155&phint=bbseg%3D900156&phint=bbseg%3D900157&phint=bbseg%3D900160&phint=bbseg%3D900162&phint=bbseg%3D900163&phint=bbseg%3D900165&phint=bbseg%3D900169&phint=bbseg%3D900171&phint=bbseg%3D900172&phint=bbseg%3D900178&phint=bbseg%3D900182&phint=bbseg%3D900190&phint=bbseg%3D900191&phint=bbseg%3D900192&phint=bbseg%3D900193&phint=bbseg%3D900195&phint=bbseg%3D900196&phint=bbseg%3D900200&phint=bbseg%3D900207&phint=bbseg%3D900220&phint=bbseg%3D7293&phint=bbseg%3D900241&phint=bbseg%3D900243&phint=bbseg%3D900247&phint=bbseg%3D900248&phint=bbseg%3D900249&phint=bbseg%3D900250&phint=bbseg%3D900251&phint=bbseg%3D900252&phint=bbseg%3D900253&phint=bbseg%3D900254&phint=bbseg%3D900255&phint=bbseg%3D900263&phint=bbseg%3D900272&phint=bbseg%3D900282&phint=bbseg%3D900286&phint=bbseg%3D900294&phint=bbseg%3D900296&phint=bbseg%3D900298&phint=bbseg%3D900307&phint=bbseg%3D900309&phint=bbseg%3D900313&phint=bbseg%3D900330&phint=bbseg%3D900331&phint=bbseg%3D900332&phint=bbseg%3D6894&phint=bbseg%3D1100533&phint=bbseg%3D1100042&phint=bbseg%3D6929&phint=bbseg%3D6947&phint=bbseg%3D6953&phint=bbseg%3D1100077&phint=bbseg%3D1100095&phint=bbseg%3D1100101&phint=bbseg%3D900002&phint=bbseg%3D900003&phint=bbseg%3D900009&phint=bbseg%3D900017&phint=bbseg%3D900033&phint=bbseg%3D900041&phint=bbseg%3D900042&phint=bbseg%3D900049&phint=bbseg%3D900058&phint=bbseg%3D900059&phint=bbseg%3D900060&phint=bbseg%3D900061&phint=bbseg%3D900067&phint=bbseg%3D900068&phint=bbseg%3D900071&phint=bbseg%3D900081&phint=bbseg%3D900082&phint=bbseg%3D900085&phint=bbseg%3D900086&phint=bbseg%3D900092&phint=__bk_t%3DOnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fwww.onmsft.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=19424937
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-191.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: 41e
Date: Thu, 18 Nov 2021 15:51:02 GMT
Connection: keep-alive
X-N: S

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 059E 0
0 67ms
67ms Image
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20211111&jk=370371658239117&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response
pagead2.googlesyndication.com/bg/ Frame 153D 35 KB
13 KB 10ms
10ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 06:37:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33230
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13296
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 18 Nov 2022 06:37:12 GMT

GET
H2 200 Your-Phone-Android-Apps-Windows-11-640x480.jpg.webp
www.onmsft.com/wp-content/uploads/2021/11/ 30 KB
30 KB 38ms
37ms Image
image/webp 104.26.15.66
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.onmsft.com/wp-content/uploads/2021/11/Your-Phone-Android-Apps-Windows-11-640x480.jpg.webp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.26.15.66 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

728ab0c54302372078c717aeffa400a77723c58d9345cebce77d303cb400ed68

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:02 GMT
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1776
content-length: 30816
x-xss-protection: 1; mode=block
last-modified: Wed, 17 Nov 2021 18:26:26 GMT
server: cloudflare
etag: "61954952-7860"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qj7lFZk4XbJ322CRod9Un6FC%2BtI0e642vIOGLG4nuj8MHa1i5VFArt4Cu7zR%2B0PEq%2FZie0S7lFtin2yi5Q0h1WoPXA8XQH1XfNd3eueLIbj258Q1x0DzdKO8YKhPnTq2"}],"group":"cf-nel","max_age":604800}
content-type: image/webp
accept-ranges: bytes
cf-ray: 6b025ba2d9893622-MAN

GET
H2 200 collect
www.google-analytics.com/ 35 B
131 B 8ms
8ms Image
image/gif 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=678711843&t=event&ni=1&_s=2&dl=https%3A%2F%2Fwww.onmsft.com%2F&ul=en-us&de=UTF-8&dt=OnMSFT.com%20-%20An%20independent%20source%20for%20Microsoft%20News&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Clarity&ea=1va86n6&_u=aHDAAEABAAAAAC~&jid=&gjid=&cid=1565518977.1637250662&tid=UA-71939551-1&_gid=1686212034.1637250662&gtm=2wgba1WKG65QB&cd5=OnMSFT.com&cd7=November%2027%2C%202018&cd8=https%3A%2F%2Fclarity.microsoft.com%2Fga%2F3vjoryfbqq%2Fm6yz7e%2F1va86n6&z=514123884

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 14:48:10 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3772
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 36 B
497 B 96ms
35ms XHR
application/json 2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=230303&v=7.2&r=%7B%22id%22%3A%2211184ffc41b47f%22%2C%22imp%22%3A%5B%7B%22id%22%3A%2227aaf62de95eba%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22id%22%3A%22327803699573c1%22%2C%22banner%22%3A%7B%22w%22%3A997%2C%22h%22%3A123%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22997x123%22%7D%7D%2C%7B%22id%22%3A%224871ee1b46336d%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22970x250%22%7D%7D%2C%7B%22id%22%3A%225deaf8efc62137%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A180%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22970x180%22%7D%7D%2C%7B%22id%22%3A%226ed8709686c959%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22970x90%22%7D%7D%2C%7B%22id%22%3A%227646fb2ae8e592%22%2C%22banner%22%3A%7B%22w%22%3A336%2C%22h%22%3A280%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22336x280%22%7D%7D%2C%7B%22id%22%3A%2286b7125c533b5d%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22id%22%3A%229d4efbdb7e25a9%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22300x600%22%7D%7D%2C%7B%22id%22%3A%22106223e5bb7a446%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22300x250%22%7D%7D%2C%7B%22id%22%3A%2211ab44ec3b11de9%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22970x90%22%7D%7D%2C%7B%22id%22%3A%22121aac7ba7962d7%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22728x90%22%7D%7D%2C%7B%22id%22%3A%22138e12227ff5da2%22%2C%22banner%22%3A%7B%22w%22%3A997%2C%22h%22%3A123%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22230303%22%2C%22sid%22%3A%22997x123%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.onmsft.com%2F%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 09c7e495b4c16e98a6bd5a5a45e908cfb8edcccd2409e96cc99199972eb032b3

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 18 Nov 2021 15:51:02 GMT
X-AK-INITIAL-GEO: CC:[DE], RC:[HE], CN:[EU], CIP:[194.36.108.19], XFF:[]
Server: Apache
Content-Type: application/json
Access-Control-Allow-Origin: https://www.onmsft.com
X-CS-CLIENT-GEO: 12
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 36
X-AK-CLIENT-GEO: 12
Expires: Thu, 18 Nov 2021 15:51:02 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
115 B 62ms
14ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.onmsft.com
date: Thu, 18 Nov 2021 15:51:02 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 644 B
3 KB 181ms
112ms XHR
application/json 2602:803:c004:200::140
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=11576&site_id=142066&zone_id=660966&size_id=2%3B15%3B15%3B2&alt_size_ids=55%2C57%3B16%3B10%3B55&rf=https%3A%2F%2Fwww.onmsft.com%2F&tg_i.site=onmsft.com&tg_i.pos=atf%3Bbtf%3Batf%3Bbtf&tg_i.adunit=homepage&tk_flint=pbjs_lite_v2.39.0&x_source.tid=c2fd5d94-da73-420d-a72c-6a58936dc223%3Bf3a60923-7191-4d2e-96e8-7a75c4e027d8%3B5b38aba5-bb87-46fe-a91d-d6be9aa1acc7%3Bcb88b528-146e-46f0-aff2-7b7ab4e47327&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=4&rand=0.8921944809001259
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 2602:803:c004:200::140 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: 2b7dd6ea1f8ef8753125dbbdb857e5e37920268c002c9c22b61e52194a524a12

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 18 Nov 2021 15:51:03 GMT
Server: nginx/1.16.0
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.onmsft.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 644
Expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 arj Show response
ziffdavis-d.openx.net/w/1.0/ 172 B
589 B 44ms
21ms XHR
application/json 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://ziffdavis-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.onmsft.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=0&tws=1600x1200&be=1&bc=hb_pb_2.1.9&dddid=c2fd5d94-da73-420d-a72c-6a58936dc223%2Cf3a60923-7191-4d2e-96e8-7a75c4e027d8%2C5b38aba5-bb87-46fe-a91d-d6be9aa1acc7%2Ccb88b528-146e-46f0-aff2-7b7ab4e47327&nocache=1637250662889&x_gdpr_f=1&aus=728x90%2C997x123%2C970x250%2C970x180%2C970x90%7C336x280%2C300x250%7C300x600%2C300x250%7C970x90%2C728x90%2C997x123&divIds=nsgpt-billboard-1%2Cnsgpt-largerectangle-1%2Cnsgpt-halfpage-1%2Cnsgpt-footer-1&auid=540322690%2C540322690%2C540322690%2C540322690&
Requested by: Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.218.0 /
Resource Hash: c500b9ec8aa695f3bbd0de51b74233cf374f25ad1cc79d871eea35543b6d7752

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:02 GMT
content-encoding: gzip
server: OXGW/16.218.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.onmsft.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 162
via: 1.1 google
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 468 B
1 KB 60ms
29ms XHR
application/json 185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.nsstatic.com
URL: https://cdn.nsstatic.com/ns/onmsft.com.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

47fe7139b30920fc0e3333b06e00a500ad68baa4cb214e9717ce2aee1c621a17

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 18 Nov 2021 15:51:02 GMT
X-Proxy-Origin: 194.36.108.19; 194.36.108.19; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 36513e79-47f1-4fc3-8586-f52f8b3bbe14
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.onmsft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 468
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
83 B 42ms
42ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=224&t=2&li=gda_r20211111&jk=370371658239117&bg=!REelRwPNAAZQLpa_UC47ACkAdvg8WmXOADXG_0ZQWuAo9SZF-tJII3w1VGK9QczOJQjKispbhIUiSwIAAABwUgAAAApoAQeZAr_zKfIX_kUBUP2nTCjmVgsv_qYCU8hMfZcjFCH-BeqAENKHa3p-WjPVUukvakS_t19WbUIIna_-Q7VcanGZY4fLkg2hBVsec-vD8zUvHRaSZZXrG8ISocHBiCuf4mv-XF_60G56jDhcQbiLUNUIcPcTD8iQiugAor615uFLbjI6BV2clfWVLBEeiHR3fl7eDg23NlxOlEp5p20DLccyWwXNO3G5VtsmehuQseTK4qYA84OnDhit35mAZ7HP0j85ZkmDC0TQkgMcD7eiHc-6h297u6kyzUEt342mBOICcY6hhpbVJAjUjXxa374dBUnGF7m8hsY4fSm6AYGN-K6Ssm7N7mT1T06Btm0VDWemVGOxqRupJUMZVZZ77rzq26jWx3Cy5r5NEMXZg6RSHLAKAXlFdWOqdPFWrKCbJzw2cFGgnpVi3k7DpD36ZNoZLtb7tKpsDxSvmyZTCwM6bKQI8_TV1qzZ7xBFULB6n9toXesmZdAu_Ek8Zf3gIo7iPbYpZ5qafjoMSIcWbG-4c3xooN9CW8zjMmCK2yc2cBYDFW3mIbjRAcwNEZo3kqih0cco_AoYQ1evz1BICSiKnYJ6TbGLq0fpdmBcFlYhr5ArsskjUBB_IvmJ4EV0x_a6-jEsfk2Kkh5NqlM9wkbQSzOtKXH2UNeq15Sww8ePGsQoem8BMnsaBX56JXnZz84EdeArUK9iurFVJRBwhuIHTVQmh8sh8K_BS3Q7a0kehgckYzUQnEVqzuHbHmUN4jB4GjFktcRwxmdcmkn4k6cK4E0RDfbg1b0IZtIvTUPbwiMEmB9v-12eJnOvTfEDj8WLfh9XY9PtWcM6GGrJkGSanJjfR_yXWBEFjj-1zPqto11wBe783_c23X2AbcczP_0-PkkP4cfPjfio0a1JUZxyqmKba2a5cxtUw9d0dzy0egesKPhu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:02 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 319ms
17ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.onmsft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 318ms
17ms Script
application/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.onmsft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 90 KB
22 KB 630ms
630ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=370371658239117&correlator=2128660927466343&output=ldjh&impl=fifs&vrg=2021111501&ptt=17&us_privacy=1---&sc=1&sfv=1-0-38&ecs=20211118&iu_parts=4585%2Cns.onmsft%2Chomepage&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=728x90%7C997x123%7C970x250%7C970x180%7C970x90%2C336x280%7C300x250%2C300x600%7C300x250%2C970x90%7C728x90%7C997x123%2C1x1%2C1x1%2C1x1%2C1x1%2C1x1%2C120x30&ists=62&prev_scp=ad_group%3Dad_opt%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%26amznbid%3D2%26amznp%3D2%26id%3D54a950f0-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%26pub%3D40%2C50%7Cad_group%3Dad_opt%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Dbtf%26pos%3Dbtf%26amznbid%3D2%26amznp%3D2%26id%3D54a950f1-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%26pub%3D40%2C50%7Cad_group%3Dad_opt%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Datf%26pos%3Datf%26amznbid%3D2%26amznp%3D2%26id%3D54a950f2-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%26pub%3D40%2C50%7Cad_group%3Dad_opt%26rfr%3Dfalse%26OOF%3Dfalse%26ppos%3Dbtf%26pos%3Dbtf%26amznbid%3D2%26amznp%3D2%26id%3D54a950f3-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%26pub%3D40%2C50%7Cad_group%3Dad_opt%26OOP_type%3Dfooter%26rfr%3Dfalse%26OOF%3Dfalse%26id%3D54a950f4-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%2C70%26pub%3D40%2C50%2C60%7Cad_group%3Dad_opt%26OOP_type%3Dstitials%26rfr%3Dfalse%26OOF%3Dfalse%26id%3D54a950f5-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%2C70%26pub%3D40%2C50%2C60%7Cad_group%3Dad_opt%26OOP_type%3Dinpage%26rfr%3Dfalse%26OOF%3Dfalse%26id%3D54a950f6-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%2C70%26pub%3D40%2C50%2C60%7Cad_group%3Dad_opt%26OOP_type%3Dskin%26rfr%3Dfalse%26OOF%3Dfalse%26id%3D54a950f7-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%2C70%26pub%3D40%2C50%2C60%7Cad_group%3Dad_opt%26OOP_type%3Dinline%26rfr%3Dfalse%26OOF%3Dfalse%26id%3D54a950f8-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%2C70%26pub%3D40%2C50%2C60%7Cad_group%3Dad_opt%26OOP_type%3Dmasthead%26rfr%3Dfalse%26OOF%3Dfalse%26id%3D54a950f9-4887-11ec-93ca-024bf4a6d028%26vw%3D40%2C50%2C60%26grm%3D40%2C50%2C60%2C70%26pub%3D40%2C50%2C60&eri=4&cust_params=url%3D%252F%26ref%3D%26gdpr%3D0%26zcp%3D2ef855a7d6aa453532a9f%26cpid%3D92d7c10d76caaa612d973043dc655c69%26amznslots%3D%26zdid%3D92d7c10d76caaa612d973043dc655c69%26zc%3D4681f5dc-4c75-48b9-b50d-20792adf7325%26p%3D900099%252C900102%252C900103%252C900109%252C900110%252C900111%252C900113%252C900114%252C900115%252C900136%252C900151%252C900152%252C900155%252C900156%252C900157%252C900160%252C900162%252C900163%252C900165%252C900169%252C900171%252C900172%252C900178%252C900182%252C900190%252C900191%252C900192%252C900193%252C900195%252C900196%252C900200%252C900207%252C900220%252C7293%252C900241%252C900243%252C900247%252C900248%252C900249%252C900250%252C900251%252C900252%252C900253%252C900254%252C900255%252C900263%252C900272%252C900282%252C900286%252C900294%252C900296%252C900298%252C900307%252C900309%252C900313%252C900330%252C900331%252C900332%252C6894%252C1100533%252C1100042%252C6929%252C6947%252C6953%252C1100077%252C1100095%252C1100101%252C900002%252C900003%252C900009%252C900017%252C900033%252C900041%252C900042%252C900049%252C900058%252C900059%252C900060%252C900061%252C900067%252C900068%252C900071%252C900081%252C900082%252C900085%252C900086%252C900092%26zdbb%3D%26m_data%3D1%26m_safety%3Dsafe%26m_categories%3Dmoat_safe%26m_mv%3DnoHistData%26m_gv%3DnoHistData%26pageviewid%3Dfe27d47e-5003-44f1-a6cc-eb28d63306f6%26fr%3Dfalse%26adt%3DveryLow%26alc%3DveryLow%26dlm%3DveryLow%26drg%3DveryLow%26hat%3DveryLow%26off%3DveryLow%26vio%3DveryLow%26ias-kw%3D%26s%3D%26p2%3D900099%252C900102%252C900103%252C900109%252C900110%252C900111%252C900113%252C900114%252C900115%252C900136%252C900151%252C900152%252C900155%252C900156%252C900157%252C900160%252C900162%252C900163%252C900165%252C900169%252C900171%252C900172%252C900178%252C900182%252C900190%252C900191%252C900192%252C900193%252C900195%252C900196%252C900200%252C900207%252C900220%252C7293%252C900241%252C900243%252C900247%252C900248%252C900249%252C900250%252C900251%252C900252%252C900253%252C900254%252C900255%252C900263%252C900272%252C900282%252C900286%252C900294%252C900296%252C900298%252C900307%252C900309%252C900313%252C900330%252C900331%252C900332%252C6894%252C1100533%252C1100042%252C6929%252C6947%252C6953%252C1100077%252C1100095%252C1100101%252C900002%252C900003%252C900009%252C900017%252C900033%252C900041%252C900042%252C900049%252C900058%252C900059%252C900060%252C900061%252C900067%252C900068%252C900071%252C900081%252C900082%252C900085%252C900086%252C900092&cookie=ID%3D855688b904e32862-22b6d2d0d3cb00b6%3AT%3D1637250661%3ART%3D1637250661%3AS%3DALNI_MbDh2KqIbfNiU0d65WgqTDUvwV0dA&bc=31&abxe=1&dt=1637250663106&dlt=1637250660905&idt=961&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C447%2C1060%2C315%2C0%2C0%2C0%2C0%2C0%2C0&adys=10%2C2984%2C1062%2C4957%2C1200%2C1200%2C1200%2C1200%2C1200%2C1170&adks=1816371679%2C1865734468%2C811131886%2C3381034896%2C400425361%2C1491668989%2C2350896866%2C2454877891%2C2350319275%2C3408557268&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca&ifi=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.onmsft.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1540x250%7C799x280%7C313x0%7C1540x90%7C1540x5377%7C1540x5377%7C1540x5377%7C1540x5377%7C1540x5377%7C1540x5377&msz=1540x0%7C799x0%7C313x0%7C1540x0%7C0x0%7C0x0%7C0x0%7C0x0%7C0x0%7C120x-1&ga_vid=1565518977.1637250662&ga_sid=1637250662&ga_hid=678711843&ga_fc=true&fws=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C512&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&btvi=0%7C1%7C0%7C2%7C3%7C4%7C5%7C6%7C7%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

acfef4e803a39000c9535a75ca01f24a305983b95e11fc836cdbf17057bfdaeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2,-2,-2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22033
x-xss-protection: 0
google-lineitem-id: 5502672901,5502672901,-1,5502672901,4910077359,4910077359,4910077359,4910077359,4910077359,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138326195346,138326616697,-1,138326195226,138256924689,138256924674,138256970531,138256924653,138256970492,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.onmsft.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 1E69 6 KB
4 KB 105ms
23ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 18 Nov 2021 15:51:03 GMT
expires: Fri, 18 Nov 2022 15:51:03 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 v2hikxFQzyc9o4HWg75LwlsvUcR5yj-O-a3RPMYTncpRnIed0dhepE_R6jh79yrjeAcd-rMoD3v1H6CmYsA Show response
chickensstation.com/ 216 B
612 B 44ms
17ms Fetch
application/json 35.186.219.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://chickensstation.com/v2hikxFQzyc9o4HWg75LwlsvUcR5yj-O-a3RPMYTncpRnIed0dhepE_R6jh79yrjeAcd-rMoD3v1H6CmYsA

Requested by

Host: chickensstation.com
URL: https://chickensstation.com/v2hqou17GCghnS4NOCIPBRrPgYaaQfmkICgh_Zauab57xLxEh8fkPe9Pb-eGb9dQT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.219.42 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

42.219.186.35.bc.googleusercontent.com

Software

Resource Hash

dfd52d8f064d5991a1206b67804f71a9d3160e5f2a1413eed36280670e5e2795

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
x-datacenter: gce-europe-west1
date: Thu, 18 Nov 2021 15:51:03 GMT
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.onmsft.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-hostname: c984a0b3
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length: 216
expires: Thu, 18 Nov 2021 15:51:02 GMT

POST
H2 200 v2qrfRuRLf77MMVfQO-zEEKcthdVRhtoRa9gYZAJ_p2sP-IAQsQ6G9NLZfh1jJdGfEc1E5XjHhCkY7rh6VA Show response
chickensstation.com/ 381 B
416 B 218ms
218ms Fetch
application/json 35.186.219.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://chickensstation.com/v2qrfRuRLf77MMVfQO-zEEKcthdVRhtoRa9gYZAJ_p2sP-IAQsQ6G9NLZfh1jJdGfEc1E5XjHhCkY7rh6VA

Requested by

Host: chickensstation.com
URL: https://chickensstation.com/v2hqou17GCghnS4NOCIPBRrPgYaaQfmkICgh_Zauab57xLxEh8fkPe9Pb-eGb9dQT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.219.42 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

42.219.186.35.bc.googleusercontent.com

Software

Resource Hash

73820cec41788325fa809ccd7f96f002fc052cb004bb2045feb3a8e023d5cfa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
x-datacenter: gce-europe-west1
date: Thu, 18 Nov 2021 15:51:03 GMT
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.onmsft.com
access-control-allow-credentials: true
x-hostname: c984a0b3
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length: 381

POST
H2 204 collect Show response
g.clarity.ms/ 0
48 B 128ms
127ms XHR
text/plain 52.182.214.99
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.clarity.ms/collect
Requested by: Host: g.clarity.ms
URL: https://g.clarity.ms/s/0.6.28/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.182.214.99 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: https://www.onmsft.com
date: Thu, 18 Nov 2021 15:51:02 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:7f62cbe7-9d8b-4a41-a628-fbaa3aa5c695

GET
H2 200 check_c Show response
zdbb.net/ 0
230 B 29ms
28ms XHR
text/plain 52.215.85.116
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://zdbb.net/check_c
Requested by: Host: cdn.static.zdbb.net
URL: https://cdn.static.zdbb.net/js/z0WVjCBSEeGLoxIxOQVEwQ.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.215.85.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-215-85-116.eu-west-1.compute.amazonaws.com
Software: Ziff Davis BuyerBase /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:03 GMT
server: Ziff Davis BuyerBase
p3p: CP="ALL DSP COR NID"
access-control-allow-origin: https://www.onmsft.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/plain; charset=utf-8
content-length: 0
expires: 0

GET
H2 200 Sticky Show response
chickensstation.com/v2bmfJBH76aRIEgkXu2ToeT6Qpc6avxE2HA7kJ6ZvN00YII7RqBLDAn1KbEVokCk3qc_8cvjqZyEU8b7J/ 45 KB
16 KB 29ms
29ms Script
text/javascript 35.186.219.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://chickensstation.com/v2bmfJBH76aRIEgkXu2ToeT6Qpc6avxE2HA7kJ6ZvN00YII7RqBLDAn1KbEVokCk3qc_8cvjqZyEU8b7J/Sticky

Requested by

Host: chickensstation.com
URL: https://chickensstation.com/v2hqou17GCghnS4NOCIPBRrPgYaaQfmkICgh_Zauab57xLxEh8fkPe9Pb-eGb9dQT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.219.42 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

42.219.186.35.bc.googleusercontent.com

Software

Resource Hash

34c9d80301ddd8577c194e8e894d525771c5ea330773bc6731c8942e3266fa2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.onmsft.com/
Origin: https://www.onmsft.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; preload
content-encoding: br
x-datacenter: gce-europe-west1
etag: "48ef637388fb1f72a6e97a965765914ba6128cd37daed579cbaffb6d3bd1d17f"
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: https://www.onmsft.com
cache-control: private, must-revalidate, max-age=21600
access-control-allow-credentials: true
x-hostname: c984a0b3
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
date: Thu, 18 Nov 2021 15:51:03 GMT

GET
H2 200 sticky-bubble Show response
my.getadmiral.com/ Frame B18B 1 KB
836 B 154ms
18ms Document
text/html 34.95.92.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://my.getadmiral.com/sticky-bubble?propertyID=A-582E614B6A735F3E706A00D7-2&bgColor=rgba(25%2C114%2C120%2C1)&iconColor=rgba(255%2C255%2C255%2C1)&horizontalAlign=left&verticalAlign=bottom

Requested by

Host: chickensstation.com
URL: https://chickensstation.com/v2bmfJBH76aRIEgkXu2ToeT6Qpc6avxE2HA7kJ6ZvN00YII7RqBLDAn1KbEVokCk3qc_8cvjqZyEU8b7J/Sticky

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.95.92.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.92.95.34.bc.googleusercontent.com

Software

nginx /

Resource Hash

095e103c11f57bcce352c3b76fbae89af807362808b618a760c160dfef10d076

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

server: nginx
date: Thu, 18 Nov 2021 15:51:03 GMT
content-type: text/html
vary: Accept-Encoding
x-hostname: quest
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-security-policy: upgrade-insecure-requests;
strict-transport-security: max-age=15552000; preload
cache-control: max-age=300
expires: Thu, 18 Nov 2021 15:56:03 GMT
content-encoding: gzip
via: 1.1 google
alt-svc: clear

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame 8B25 47 KB
14 KB 121ms
58ms Script
application/javascript 34.254.9.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=7529&campId=300x250&pubId=53576252&chanId=194640332&placementId=5502672901&pubCreative=138326616697&pubOrder=169870292&cb=1518585077&adsafe_par&impId=54a950f1-4887-11ec-93ca-024bf4a6d028
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.9.67 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-9-67.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: db02d0faf424a7ebc376ec36b7063b8b397d606dcb44fd0f14c976fcbd991c49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: gzip
x-server-name: app17.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CF53 0
0 44ms
43ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuGgUXRMSleKV1DL8yWzn6iKCzCHGgLHBjXlPHN9btFo0gOu0jzVW-B1tYTobe00-vqy90KO-2V8h6KErrZmOHmMlZTvpjcIqMtR-G_gZMHoLorPE-qUMa10n5_wpT01o3o-BJWKUcsENlax981qI60uCCSAymmy27pmfH2QTe4z9wqEssCVfUckdzVo3LshEZrRrAou5zkxqx-5QE0mUPmWLEDu-0sbetnPO3Onz2mk-O3ZE5lcrasaIp6F7tfE0XSC5t0EI00qSRjVw1dNd303dZKX-j1O4Fs_Bh_do7gE6ZFthVeD5Xisw&sig=Cg0ArKJSzKkFyeY7WorBEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 tyche.js Show response
cdn.intergi.com/hera/ Frame CF53 168 KB
54 KB 121ms
120ms Script
application/javascript 2600:9000:211e:f800:14:2602:6e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergi.com/hera/tyche.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:f800:14:2602:6e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: c5188a63ae5821b2252177fdc0e92545890211f43afe037f635ba2cb9d72c094

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
via: 1.1 dca6db3c8f31f3cd48bb06d78a8be625.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
cache-control: max-age=600, public, must-revalidate
content-encoding: br
x-amz-cf-id: V7Q6_D84Grt_Ryngl7SfHskLCCYqr77oD2IN32Vxm3PAGwDN9x4ndw==

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame CF53 119 KB
37 KB 46ms
20ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 18 Nov 2021 15:51:03 GMT

GET
H2 200 jload Show response
pixel.adsafeprotected.com/ Frame BDD8 47 KB
14 KB 112ms
62ms Script
application/javascript 34.254.9.67
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.adsafeprotected.com/jload?anId=7529&campId=970x250&pubId=53576252&chanId=194640332&placementId=5502672901&pubCreative=138326195346&pubOrder=169870292&cb=111882097&adsafe_par&impId=54a950f0-4887-11ec-93ca-024bf4a6d028
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.9.67 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-9-67.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 077740dd091fcb598214095438d3e3d87578fe30cb74ea2b4454e47d1a6acdd3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: gzip
x-server-name: app05.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: pixel.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 95E9 0
0 43ms
43ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsscsfRTbBeWFYCpfIt5fNndYXGiKUz1PYxQBf1ogQsKcUizwHwZPsSd6ruQklA3v3gHAr8FhIiePfQ5GL-qRnqJumG7DUL4VHY_01j9fp69v4aJai9mlNuUOS7JZIb957Izj3J2Uq4zvBBAUNemrRp2WY4s3L4ZkbQ3wWxA_oAAvZ_S4m8XUwsyUQtReTUKMxoiCnYZpH3smPyWh3pp1xCo4AVAiq3gK4CWxK0MgdKH3V5dJ-0RvIpX-Tf8UJjQPvZ6LPHUwlfxjQWqfmp3E_KC0u3yNn7giyz_4qKaQtCAy09OvivB7zrTNg&sig=Cg0ArKJSzIABAZFJLnq3EAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 tyche.js Show response
cdn.intergi.com/hera/ Frame 95E9 168 KB
54 KB 110ms
109ms Script
application/javascript 2600:9000:211e:f800:14:2602:6e80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergi.com/hera/tyche.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:f800:14:2602:6e80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: c5188a63ae5821b2252177fdc0e92545890211f43afe037f635ba2cb9d72c094

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
via: 1.1 dca6db3c8f31f3cd48bb06d78a8be625.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=600, public, must-revalidate
content-encoding: br
x-amz-cf-id: qtLgdGS4wvi8Pm3bNfdIPLKwqCQG0kmLiO3vsTzoDcoLyLzafO1XaQ==

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 95E9 119 KB
36 KB 59ms
44ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 18 Nov 2021 15:51:03 GMT

GET
H2 200 container.html Show response
90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 2E2F 6 KB
3 KB 10ms
9ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Thu, 18 Nov 2021 15:51:03 GMT
expires: Fri, 18 Nov 2022 15:51:03 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame FCE8 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8802ba4a157c0e4b8fdd090f86e17761688391681c9dcc41f3af077b44b2931d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 1153452811013376518
tpc.googlesyndication.com/simgad/ Frame FCE8 826 B
1 KB 10ms
9ms Image
image/gif 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1153452811013376518?

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba2ad3ab1a3bc76b2d09ae1becfd7e6bd9d868eecc6af4d2fed12915d1d77315

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 11:05:59 GMT
x-content-type-options: nosniff
age: 189904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 826
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 21:31:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 11:05:59 GMT

GET
H3 200 view%3Fxai%3DAKAOjsv-mlx3aDTCYDK4XAbnWhy-RhcPtI1V9n10mHaMUNi0nLkxYCP6lIQgKvPwktuWk2c8_P4A1SAgpa5I9DrCI6x9wPFKLPMY1w0P02TpDCutRNyLRFfY5KO1LUh4y1femLRG6-kAC6b-hob25wCGBM_SbJAHdkz2l3P4JpP7hVwViLA9MH7k...
securepubads.g.doubleclick.net/pcs/ Frame FCE8 0
23 B 21ms
21ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view%3Fxai%3DAKAOjsv-mlx3aDTCYDK4XAbnWhy-RhcPtI1V9n10mHaMUNi0nLkxYCP6lIQgKvPwktuWk2c8_P4A1SAgpa5I9DrCI6x9wPFKLPMY1w0P02TpDCutRNyLRFfY5KO1LUh4y1femLRG6-kAC6b-hob25wCGBM_SbJAHdkz2l3P4JpP7hVwViLA9MH7kic4dKsA8aT0tUvs48eBaSpq66VNiZVRyhbT5N1n4VBE6ahVAe6F4s4sSrIMky7LRPyibO7wZZmDxRiOmxba3l5cVlIFaBKggquRycxFzjbU0QXR9MEBKys9YYfc2DiI6HDbDMw%26sig%3DCg0ArKJSzPX-3VbzSglUEAE%26uach_m%3D%5BUACH%5D%26urlfix%3D1%26adurl%3D

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 1153452811013376518
tpc.googlesyndication.com/simgad/ Frame FB35 826 B
887 B 8ms
8ms Image
image/gif 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1153452811013376518?

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba2ad3ab1a3bc76b2d09ae1becfd7e6bd9d868eecc6af4d2fed12915d1d77315

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 11:05:59 GMT
x-content-type-options: nosniff
age: 189904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 826
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 21:31:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 11:05:59 GMT

GET
DATA 200
OK truncated
/ Frame FB35 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0ff5b741ce41680cf5ac37e619e1c35cbe4f1dd7f812dcd68924a126a6959b33

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view%3Fxai%3DAKAOjsu878b_Ym_mjnP1WetUp-vLAS23FYGwB0M8L2_LdPAC85yAoT9UBkP8BggWeppWXYL-wKxqH_vgifnHBhHRfZeXLEVti1uxswY-pyOj0dveiWEGbXQTrOef51L0-bsA8ud3eNTtwrHJP6_6a3JXithX5yTRwiNIqoOzyPXKNYGNdABH9r3e...
securepubads.g.doubleclick.net/pcs/ Frame FB35 0
23 B 19ms
19ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view%3Fxai%3DAKAOjsu878b_Ym_mjnP1WetUp-vLAS23FYGwB0M8L2_LdPAC85yAoT9UBkP8BggWeppWXYL-wKxqH_vgifnHBhHRfZeXLEVti1uxswY-pyOj0dveiWEGbXQTrOef51L0-bsA8ud3eNTtwrHJP6_6a3JXithX5yTRwiNIqoOzyPXKNYGNdABH9r3ecGeFPOI4cZs0BCedwRHQ3YfHo9SvjY__4_eSYvk0RSnSxeVb9EmQCijfk72WKpmAvUOcvKneuQsd9bfcDxC3X65sF4fk7rwM1IvaX4-V56-8qgsR8DNuVy5FE5UznLsqvvjlDQ%26sig%3DCg0ArKJSzN6ciZdakHC7EAE%26uach_m%3D%5BUACH%5D%26urlfix%3D1%26adurl%3D

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 1153452811013376518
tpc.googlesyndication.com/simgad/ Frame 1D03 826 B
887 B 8ms
8ms Image
image/gif 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1153452811013376518?

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba2ad3ab1a3bc76b2d09ae1becfd7e6bd9d868eecc6af4d2fed12915d1d77315

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 11:05:59 GMT
x-content-type-options: nosniff
age: 189904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 826
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 21:31:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 11:05:59 GMT

GET
DATA 200
OK truncated
/ Frame 1D03 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 857a370261cc81c30486931ed1f8a6aaa33f439114de8e2ba59f6046e0e9febb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view%3Fxai%3DAKAOjssnYsdRntZQSy_XvqSGw75wjUL6hJc_0aXnWHBtZyg7VMKMlsktkvwt4_CzkMY3ITbmflCgkeNPEUxV8bLDzA3sCXgmzVRXnMP2tJKLgUofczxSr_EFbYeRWg5ZWA8jVV4lkqpuXTm4HDte5Oi0LyLUg1LtdgTx7GqEe3gwglCHyTAUzmtP...
securepubads.g.doubleclick.net/pcs/ Frame 1D03 0
23 B 19ms
18ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view%3Fxai%3DAKAOjssnYsdRntZQSy_XvqSGw75wjUL6hJc_0aXnWHBtZyg7VMKMlsktkvwt4_CzkMY3ITbmflCgkeNPEUxV8bLDzA3sCXgmzVRXnMP2tJKLgUofczxSr_EFbYeRWg5ZWA8jVV4lkqpuXTm4HDte5Oi0LyLUg1LtdgTx7GqEe3gwglCHyTAUzmtPPmSh7d6JLPlqcojt5K1mXBPwFavqRAEvFGUWWRFU1YoX0OOgx7v8xDbUaFCvAcdopK502Kp0W6W1r1hELodKrhWmBc4aVgHAG9P0NxT-J679s_7MEgp49WqsscWzowSh7aI1Yg%26sig%3DCg0ArKJSzGIiBOqBzpX8EAE%26uach_m%3D%5BUACH%5D%26urlfix%3D1%26adurl%3D

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 1153452811013376518
tpc.googlesyndication.com/simgad/ Frame 0351 826 B
887 B 8ms
8ms Image
image/gif 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1153452811013376518?

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba2ad3ab1a3bc76b2d09ae1becfd7e6bd9d868eecc6af4d2fed12915d1d77315

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 11:05:59 GMT
x-content-type-options: nosniff
age: 189904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 826
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 21:31:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 11:05:59 GMT

GET
DATA 200
OK truncated
/ Frame 0351 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 81cbac68a8a375ddbacaef7e44bebbf57ff3709337c631f41ce6a49996c1c861

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view%3Fxai%3DAKAOjssAP-C0pDdWYOigiqf_wy0TnLx748ZqbZF_yuTacRuCoUQQIIqZOl747OViqgVeK3CP2dJfCIok9h7XjlCxHa8hmTUWLUxnm2BGsOp7Jp67B009Har2G6VX3SE6A5WvIexrBmGG_Nqx9YG-2oYRz7e5tFl_FGcdsIXibzWzJRYFyuWqrJwd...
securepubads.g.doubleclick.net/pcs/ Frame 0351 0
23 B 20ms
19ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view%3Fxai%3DAKAOjssAP-C0pDdWYOigiqf_wy0TnLx748ZqbZF_yuTacRuCoUQQIIqZOl747OViqgVeK3CP2dJfCIok9h7XjlCxHa8hmTUWLUxnm2BGsOp7Jp67B009Har2G6VX3SE6A5WvIexrBmGG_Nqx9YG-2oYRz7e5tFl_FGcdsIXibzWzJRYFyuWqrJwdi2rTMci9_WbWJgK2PdKAZhwJJE_fFRpfobSHKTo56_fPH129en8Wm8_lIH7nDkV71oAMIwsSSQMeFdIlrDt5fTqumYLZs1LJGbnsVoCkD1mgXYPQMjiIZf6niTz8Jj39-AWNWQ%26sig%3DCg0ArKJSzLeQYQuHHbZdEAE%26uach_m%3D%5BUACH%5D%26urlfix%3D1%26adurl%3D

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 1153452811013376518
tpc.googlesyndication.com/simgad/ Frame 52F5 826 B
887 B 8ms
8ms Image
image/gif 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1153452811013376518?

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021111501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba2ad3ab1a3bc76b2d09ae1becfd7e6bd9d868eecc6af4d2fed12915d1d77315

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 11:05:59 GMT
x-content-type-options: nosniff
age: 189904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 826
x-xss-protection: 0
last-modified: Thu, 03 Jan 2019 21:31:22 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 16 Nov 2022 11:05:59 GMT

GET
DATA 200
OK truncated
/ Frame 52F5 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1124180d382cf3f1dbab161bd5c6f1966f75d4283332e4db2f7c20bd5194726

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view%3Fxai%3DAKAOjstI5F1UIRAC1-yeAmr3zds5ueZ9N_nxoAq53UHaqjeCziOq4y-hu95enwhcaUIbyII0KoXyVjZg_VsGoXUAr95ZfyGVVvo6z19KcfoV-iZoqabbDfAB92NjBczcuAscjm0x5LGJCCH8WdA0ElCkN5a3tXfR8emle6wvdngkg6MBU_p6d6fy...
securepubads.g.doubleclick.net/pcs/ Frame 52F5 0
23 B 26ms
25ms Image
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view%3Fxai%3DAKAOjstI5F1UIRAC1-yeAmr3zds5ueZ9N_nxoAq53UHaqjeCziOq4y-hu95enwhcaUIbyII0KoXyVjZg_VsGoXUAr95ZfyGVVvo6z19KcfoV-iZoqabbDfAB92NjBczcuAscjm0x5LGJCCH8WdA0ElCkN5a3tXfR8emle6wvdngkg6MBU_p6d6fyRlCaqkQubq7CVNr5aoRaq_lj2PkHmu_v3NAYSpNlak6R7VgLTbzJXoREw99mUjzm3oWd-nyBXXCbpssULJlmodOG3OJ3To-tqmq7r1ksGRXUTURSzHbx50PyeIvONxJ1jEPrYg%26sig%3DCg0ArKJSzICR5aPBlzwREAE%26uach_m%3D%5BUACH%5D%26urlfix%3D1%26adurl%3D

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:03 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 bundle.5e1ee.css
my.getadmiral.com/sticky-bubble/ Frame B18B 4 KB
1 KB 19ms
19ms Stylesheet
text/css 34.95.92.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://my.getadmiral.com/sticky-bubble/bundle.5e1ee.css

Requested by

Host: my.getadmiral.com
URL: https://my.getadmiral.com/sticky-bubble?propertyID=A-582E614B6A735F3E706A00D7-2&bgColor=rgba(25%2C114%2C120%2C1)&iconColor=rgba(255%2C255%2C255%2C1)&horizontalAlign=left&verticalAlign=bottom

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.95.92.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.92.95.34.bc.googleusercontent.com

Software

nginx /

Resource Hash

08b936e11e496c1c84af9020c96c66829f9aef934a0754f44b24706505034b23

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://my.getadmiral.com/sticky-bubble?propertyID=A-582E614B6A735F3E706A00D7-2&bgColor=rgba(25%2C114%2C120%2C1)&iconColor=rgba(255%2C255%2C255%2C1)&horizontalAlign=left&verticalAlign=bottom
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
date: Thu, 18 Nov 2021 15:51:03 GMT
vary: Accept-Encoding
x-hostname: quest
content-type: text/css
via: 1.1 google
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; preload
alt-svc: clear
x-xss-protection: 1; mode=block
expires: Sat, 18 Dec 2021 15:51:03 GMT

GET
H2 200 bundle.023d3.esm.js Show response
my.getadmiral.com/sticky-bubble/ Frame B18B 38 KB
14 KB 21ms
21ms Script
application/javascript 34.95.92.134
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://my.getadmiral.com/sticky-bubble/bundle.023d3.esm.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.95.92.134 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

134.92.95.34.bc.googleusercontent.com

Software

nginx /

Resource Hash

aa19b4b863038abcb52c6fb867b4d1189a7d1be3d174df57751865890ec06acb

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://my.getadmiral.com/sticky-bubble?propertyID=A-582E614B6A735F3E706A00D7-2&bgColor=rgba(25%2C114%2C120%2C1)&iconColor=rgba(255%2C255%2C255%2C1)&horizontalAlign=left&verticalAlign=bottom
Origin: https://my.getadmiral.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

content-security-policy: upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
server: nginx
date: Thu, 18 Nov 2021 15:51:03 GMT
vary: Accept-Encoding
x-hostname: quest
content-type: application/javascript
via: 1.1 google
cache-control: max-age=2592000
strict-transport-security: max-age=15552000; preload
alt-svc: clear
x-xss-protection: 1; mode=block
expires: Sat, 18 Dec 2021 15:51:03 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 57FA 624 B
344 B 24ms
24ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQ5su2qgIYyfyctwEwAQ&v=APEucNWhDBml9a-_xgYXmPMvnFcSNYb92RFkOUo2a6AJ2iwNLXndp2AlwGlE_v4zZrC-zBjPJHsiKGuLKlndr0b3NIs31u4i-1uPlYx3Yrbj8nlhtdmXKWUxkmgB-vCw4W67pwcjNnNn4OdVoFwCkthAgX9v_37ye_6REuHZZzDiwFteWK4ES-U

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 18 Nov 2021 15:51:03 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2E2F 79 KB
31 KB 78ms
78ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-COgYiKKIz3CZZ7wn-HeXOETGoZtahR9-vLTFz8kPXLAiOs_62FzRK2HVl6cTXhONrAmcFmdUrWoXbSVsbTKEoyOtxbyoHlowcVSBUOL4dsj6Q3W2o37mKpfY2Lrg6wkZGPjL3yDDeMw4he91Sz8Y0t-5qRww&dbm_d=AKAmf-D4iHabahh1VRZq4AYdD_10OUq6O28aXp7nj7TXP0cjlVq8zFD2XTYs0-5iolXwKTSTvapEAE8i_i0_tIwIwIjmbGyVgHk2Zyphl-yOnilgOfM0mHwRizPZYBmLC4Jm52_wOBpeEVhRb_P3rvtBkI-7RpgKh21G0WpH1gkl44k-YYOYzHlB2-Mr5igFsBuAGq_Xdd1dy9PJ88kcC2mBHwy4WptzfYO3_3OKeFq5rTy-i-TbP2kEEZbf1fGDQ99KL448usiMvaROuUvYWp0siivPyZhpkM-Nhm8sH2nys9xhLlu4ITNHlAMAHnyI8gHTTAZaVmNjgugbyDb-6wqYVJl2HKNI6DY1lQYZaRpEoyp5kxFPzuzy99TSoz5pq_9a_kyaQuxWFIBCXhQ02Pj7HZyUuRYk6oNkasooiMn215cxD-4XEsiHvWWzvY-Qkxgd0BLVmBJD8P828u1glxiATg_7-e5t0j64a13jlDwDNs7Inw96CZE-pQauBXGAkiwDbQRUA9ubgWbqTkbMeVUN9IldAzr5r9FT3eLscLlhJiDLdO8RRJp8amm4UhfbFG-J4174yHQM4Im5mAtE-HNI4--jwn-Pi8PzV-f0LT-j84I4eqQsXwb8e80z5Rk3ojRUd9qBtHZnCaHYacLvpeMjjM_W7amTIDrN3qsNiXhEDTr9qm0bPs-XAaNDlzWCN9shaRJvL71nnAdIXR-Bh_YAbC55BWjdqMC68mWNrMxv5aVDBl-aTCr5Z08N7aNn7XzphqtW56K2LNwvGBgALzRcXI-3v6T6F35BbBD_cqEZK1BRvWVLkHQIcFY_sUWMz1j1RAlMsh4CwNeOQ3LRrBJpGVp6-SIvQ4AIL7qt3SVwkjwMVtT4Ha0CePSCc6WOMNpZyfAVqu10QI4i6R0VWC7wbKK3lmQwDTq3KxUrI_jCa6iiEvD6s-d_mtgMvK4W7SdxRNZceR1LYfOhfdux6qY3qgc6-CeVx5VLXvqYUwWUY1JVHda0N75-7cwACPF0YJB4QIOd-R7Nale3zOAYHybd_z_RadkXXdfRgZsv9ggT5KrJXbAvba9JfMEwOu47A46z08OBx-fhp2UIgefqOBGRtDNB-Ksl6OVtrQ813iR9bQa8XqbF6i20BThu3O9HYQTEunxdbI7VVct_ChBT14PuhxaAHyDNdUdManIcJlmCoZXYu7oL88iofGVdWPzOj26zV9x60yKLo7zfWcmnJr_mNafOlGvDXsA80CqrGW75DurEQVc-IgXcnMLb2pFILVJdKMM26RsT97T3agUGZVk6i21EydXvDpkPf4FN-Jpi4i6LNQ90DaKJQ7gx3on1CTA1dXKOuLjvaidrbEeMhJJ4jZ6FBMdL3y5HDbA7QRy_e9ezQE3nkWEd9FU5Sb-0TGEnjUCCMqO0k8oovFGLJelXlluSqdJzrOCbVwAxbMb3vkaK_iWwRveZw7dAxvLebl9AnR7-Ye3goZU4ZHlSmt17rQV2pSu1Psa1f_0dQkN8ErRebyKaLPIR0iW8z1aa2DhoeDB0JUsVD6o94-FSpUakF7G090K9BAizIB1Lv74eyubvqjjj-LMUxPd8IPqah6nUdIkubgmzO4IOEnT8zvGoZFBZMAt2L_8-kcKjv5uC7KV-wfgUDoqMGIvZjpVjW86mo0cvBj3vVLHzvXTBhigdxVGr1Y8oemdclRxjRtrzAeuT6MfonDk698PLPuWeFFgNfWZaa2TPIyvXjg2UA6CmnltSEe0HEwM5aV7wV4NPAwyd-PSMSobB5Iveax99Wp_7r5fnd7nH50-QaA3mglEupA_rD_EJdiyLUaZQx-jLt2J-fM1r2OZ9G_GF84y05C6TeDVlnTtVE4u-1yCFEWlKcE9nwiWnaviTwzdeajzDJlk3zYOeI2KCqRMc9DXLmhSiMH6nwerJATXpUn5qhaic97Tbcd26jp1aSts0JJQt02NQnAL9NYpk_qVYm8Omb0zlorJ2MIqytbrVoknZsqxlRIy4BzxvaxJfVkjZCkMmTtTkWhvGt_glFVRMxo97ynl9i4Bafl7hbbIlTft_H6J7sbdXsU1aTK6Oo3Ly78eQb6RKBOkw55zv5_TRLbdDQKM4L9RjtpqcMVG212LeB9vx8mA24_ItD9n10dqv-YRWTjEgnakL5PPkxNDjvMwbi0SdR18eCkMBnYCt8280EKxmzFip8uJC9x1NKmglBYjRLHdlXW8wSRL2wFSxb_PhCpkrn87E5LKEIO6DIA7qBNKoHiWzbVUUmZeGO0bLlhOZAE8Fa2u0ko-gwG4PzNQlsAkdZY6l9CxK86t1fdouDggy3cHoYsskZb531TmnDTe5lXOP4kcufZyPCIJ4M7mxY5kPZHUP0enp41fTFiUEJxt25tkHiFOSKOKFQfSP7ng9kP00KxUHtLokSaf7COVdvU83WzBNznqIlHT6KeBO8ghWqc8tg5ivSta3N7rWLtMDVZn_bzbb8cYiU35I8vmY1pkddKImCVkVYUOuFWALnxGz7u-QVw7GkZf0a8V7Pr_aKdzD9A3Fi7h6caEv8szjwp9w0D3PLWHhZHB2zYRUIcnlqvfLM4p3LrIWhZ195MKRHuVDNbRzvaC5gjfBLtVfr3_EAlMsBdFN2vIBazMm7NTwCCqto44_SYfg6WDyQCrUPP4hDwhAUDk5rquoA9FUbGsv5W7L9c0jw7YZM-A6XH8cmyt_DD3SToArPWNIgl89Ha0ihzKXQQP20fP95gnH0ZhzSaBVZh1zSXGGerAPcEbM132Arfr7Nt619emrqUBjqIimCsu1jp6LcKCeiECPzuXcFvcsN_cFmwUaOfBRYHEaR7x10vSOiXExfIb257RgVFECbl3JWHU_dG2v65tyfi2MuTgtik6FAQzbhBK0Ul2kB97Y9MF7FA85l2h95TPmOfcdPGKnsXkPigIEaZ-bxXWBGnmn5wT7Y36_hmplDSFNSgBQLdYRvdu-lmnW4xj43N389WsFRLqVT2F8JkrPrsIU0FRQtNxAWWv1O2Bl7_fGIlATvKz1acKB6QyH7V_8PXtRwxeRmPf8zbu9Oxs-wponapdu0gZ1ydbXEM06kjD9fVzh9GPKCjrcuXLoxhyNVjCa9JTR47eBd4pTU18ZgnCQUkngBQ0NSKAiY2fbh-qXh4FB-VMPRAxm6rDBhC_bvBgOSlvaL5Xs0-9RBYM9hh2JOXi4ezdAKAoXhD7xxCL4FXXeXbde4hn36FGxGgzIsaB880XUWTk&cid=CAASEuRovy-om35Ng1qS8llVxS8r2A&rfl=1%2Chttps%253A%252F%252Fwww.onmsft.com%252F%240

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4cac22856ca12ba1ff5560960edecd6012330c3d3ad11b4000133a84b320b4ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31646
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2E2F 42 B
110 B 53ms
53ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cm5F_4hwIOYqyEHRd-j0tNvYO6-zODp2S0ZiuEZgD1N6HA7B9rdpKySpqPwqcrE_Kd4ZXQAQIkHf4cmJLFbwwGP6I22tBD6xxiaW5HX1KfBIRqk2c

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:03 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 2E2F 2 KB
2 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/window_focus_fy2019.js

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:28:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1377
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1332
x-xss-protection: 0
server: cafe
etag: 3351516697335751560
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 02 Dec 2021 15:28:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2E2F 119 KB
36 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37119
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1636547677202025"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 18 Nov 2021 15:51:03 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/ Frame 2E2F 15 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20211111/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:48:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 130
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6415
x-xss-protection: 0
server: cafe
etag: 16810888504096353422
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 02 Dec 2021 15:48:53 GMT

GET
H2 200 main.gr.19.8.267.js Show response
static.adsafeprotected.com/ Frame 8B25 187 KB
60 KB 19ms
19ms Script
application/javascript 2600:9000:211e:1400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.267.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=7529&campId=300x250&pubId=53576252&chanId=194640332&placementId=5502672901&pubCreative=138326616697&pubOrder=169870292&cb=1518585077&adsafe_par&impId=54a950f1-4887-11ec-93ca-024bf4a6d028
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 724d5e151b4ba82f7eaf29667bed3a5ae2167a00343cfbcf2ebed5df806d914e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 08 Nov 2021 16:59:44 GMT
content-encoding: gzip
age: 859880
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 08 Nov 2021 16:44:16 GMT
server: AmazonS3
etag: W/"3969d0944eda724d44536ffabb874cbe"
vary: Accept-Encoding
x-amz-version-id: 4WBF5SKEzUvdXUVA6w23d2Sq_.qCUBCq
via: 1.1 3d58896f901dbeed449603f5d2b4d9f1.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-C2
content-type: application/javascript
x-amz-cf-id: MzEBmaYUcXkGkOXpCQ0uMvEsf_vLXulUiAUvliAMB9MzXhsGWX1xcg==

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 57FA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPimU3D23FlZ1gWc2xITh10&google_cver=1

43 B
1014 B

69ms
26ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPimU3D23FlZ1gWc2xITh10&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQ5su2qgIYyfyctwEwAQ&v=APEucNWhDBml9a-_xgYXmPMvnFcSNYb92RFkOUo2a6AJ2iwNLXndp2AlwGlE_v4zZrC-zBjPJHsiKGuLKlndr0b3NIs31u4i-1uPlYx3Yrbj8nlhtdmXKWUxkmgB-vCw4W67pwcjNnNn4OdVoFwCkthAgX9v_37ye_6REuHZZzDiwFteWK4ES-U
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 18 Nov 2021 15:51:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 18 Nov 2021 15:51:04 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPimU3D23FlZ1gWc2xITh10&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 57FA
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YZZ2aH5RywDV9FYolBiE7wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPimU3D23FlZ1gWc2xITh10&google_cver=1

43 B
894 B

38ms
38ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPimU3D23FlZ1gWc2xITh10&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQ5su2qgIYyfyctwEwAQ&v=APEucNWhDBml9a-_xgYXmPMvnFcSNYb92RFkOUo2a6AJ2iwNLXndp2AlwGlE_v4zZrC-zBjPJHsiKGuLKlndr0b3NIs31u4i-1uPlYx3Yrbj8nlhtdmXKWUxkmgB-vCw4W67pwcjNnNn4OdVoFwCkthAgX9v_37ye_6REuHZZzDiwFteWK4ES-U
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 18 Nov 2021 15:51:04 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 18 Nov 2021 15:51:04 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPimU3D23FlZ1gWc2xITh10&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 57FA
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEBxdba0xyksw79Oi6VQOwqM&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEBxdba0xyksw79Oi6VQOwqM%26google_cver%3D1

43 B
1 KB

138ms
137ms

Image
image/gif

185.33.221.52
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEBxdba0xyksw79Oi6VQOwqM%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COvS1gIQ5su2qgIYyfyctwEwAQ&v=APEucNWhDBml9a-_xgYXmPMvnFcSNYb92RFkOUo2a6AJ2iwNLXndp2AlwGlE_v4zZrC-zBjPJHsiKGuLKlndr0b3NIs31u4i-1uPlYx3Yrbj8nlhtdmXKWUxkmgB-vCw4W67pwcjNnNn4OdVoFwCkthAgX9v_37ye_6REuHZZzDiwFteWK4ES-U

Protocol

HTTP/1.1

Server

185.33.221.52 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

725.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 18 Nov 2021 15:51:04 GMT
X-Proxy-Origin: 194.36.108.19; 194.36.108.19; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 46b5a3a8-345f-4f4f-bffb-cd9b38b7f5f5
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 18 Nov 2021 15:51:04 GMT
X-Proxy-Origin: 194.36.108.19; 194.36.108.19; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 4172b475-7dab-4080-8a93-321a7950daa8
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEBxdba0xyksw79Oi6VQOwqM%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 57FA
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg3NTQ4Nzk0ODc3NjEzOTk1MQ%3D%3D

170 B
188 B

51ms
36ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg3NTQ4Nzk0ODc3NjEzOTk1MQ%3D%3D

Requested by

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 18 Nov 2021 15:51:04 GMT
X-Proxy-Origin: 194.36.108.19; 194.36.108.19; 725.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: be230f91-49f4-4d33-a64f-530112e9e96b
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTg3NTQ4Nzk0ODc3NjEzOTk1MQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 main.gr.19.8.267.js Show response
static.adsafeprotected.com/ Frame BDD8 187 KB
60 KB 35ms
35ms Script
application/javascript 2600:9000:211e:1400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.gr.19.8.267.js
Requested by: Host: pixel.adsafeprotected.com
URL: https://pixel.adsafeprotected.com/jload?anId=7529&campId=970x250&pubId=53576252&chanId=194640332&placementId=5502672901&pubCreative=138326195346&pubOrder=169870292&cb=111882097&adsafe_par&impId=54a950f0-4887-11ec-93ca-024bf4a6d028
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 724d5e151b4ba82f7eaf29667bed3a5ae2167a00343cfbcf2ebed5df806d914e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Mon, 08 Nov 2021 16:59:44 GMT
content-encoding: gzip
age: 859880
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Mon, 08 Nov 2021 16:44:16 GMT
server: AmazonS3
etag: W/"3969d0944eda724d44536ffabb874cbe"
vary: Accept-Encoding
x-amz-version-id: 4WBF5SKEzUvdXUVA6w23d2Sq_.qCUBCq
via: 1.1 3d58896f901dbeed449603f5d2b4d9f1.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-C2
content-type: application/javascript
x-amz-cf-id: iyoE9ZRnX_G58SplikuB3aFedn14v92ibI8dA0SAohakKIlr6_Nm6w==

GET
H2 200 batchHandler.292de00282b644b2ec50.js Show response
cdn.intergient.com/pageos/1.6.29/ Frame 95E9 3 KB
2 KB 9ms
9ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/batchHandler.292de00282b644b2ec50.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 225a5d44793400c62040e70a55fc77beed0a3cbc0d7ac361abbf4085392b1e20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 14:37:11 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:39 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:de92c4772058b0bc43087610c61d14a5/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 4433
etag: W/"de92c4772058b0bc43087610c61d14a5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: os68dwS6Zbi0ZxSoNKnetu1XdYy_pZA2JAR1howtcNwgd1JFubNDfg==

GET
H2 200 banner.json Show response
config.playwire.com/1023788/v2/websites/71908/ Frame 95E9 21 KB
3 KB 15ms
15ms XHR
application/json 2600:9000:2057:5a00:1a:1459:5cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.playwire.com/1023788/v2/websites/71908/banner.json
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:5a00:1a:1459:5cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 949192cf915ba5e7aa5ee91f12efccc64db5f7f5c99ca44e9e6a7634c1a64428

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 22:59:58 GMT
via: 1.1 vegur, 1.1 d07eabeb1ed60c06da1457f35fb5c8c5.cloudfront.net (CloudFront)
vary: Accept-Encoding
age: 60665
x-cache: Hit from cloudfront
content-encoding: br
server: Cowboy
access-control-max-age: 1728000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: hw-country-code
cache-control: public, max-age=600
hw-country-code: DE
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: zusrU2mVjkG-vo4hiE2shKZajO-uyPVRDxIMt5srMBmULrVWM9MRDA==

GET
H2 200 moatheader.js Show response
z.moatads.com/playwireprebidheader597261727146/ Frame 95E9 214 KB
75 KB 26ms
26ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/playwireprebidheader597261727146/moatheader.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 8e662cd2ca55a4bddd132966304a69f7643154d359c97ab4850606922be42556

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:03 GMT
content-encoding: gzip
last-modified: Tue, 02 Nov 2021 14:45:26 GMT
server: AmazonS3
x-amz-request-id: P9CXSHBDCGRCHB6K
etag: "5e40994da788591853a03ad1379eff9b"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=43540
accept-ranges: bytes
content-length: 76349
x-amz-id-2: ZcNVvok1ZAEFpeE6S8Wxb2i2sxpjOeblPvh84A+t0v4JkQWjAKLl4/SFAo1HCtZxcyzhtnaWBcc=

GET
DATA 200
OK truncated
/ Frame 95E9 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a07ab1bfcc027604b196e3123c4d4c143cbd842d907ce7783404ed476f6d4d46

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 express_html_obb_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 2E2F 119 KB
42 KB 54ms
7ms Script
text/javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_obb_rendering_lib_200_275.js

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a57cecd2bf4d6d3b8498c67487333f6dc9e102371f5e48ffc7fcf18a6e8487e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
Origin: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 11:12:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 16737
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42555
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:53 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 19 Nov 2021 11:12:07 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/ Frame 2E2F 8 KB
3 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-COgYiKKIz3CZZ7wn-HeXOETGoZtahR9-vLTFz8kPXLAiOs_62FzRK2HVl6cTXhONrAmcFmdUrWoXbSVsbTKEoyOtxbyoHlowcVSBUOL4dsj6Q3W2o37mKpfY2Lrg6wkZGPjL3yDDeMw4he91Sz8Y0t-5qRww&dbm_d=AKAmf-D4iHabahh1VRZq4AYdD_10OUq6O28aXp7nj7TXP0cjlVq8zFD2XTYs0-5iolXwKTSTvapEAE8i_i0_tIwIwIjmbGyVgHk2Zyphl-yOnilgOfM0mHwRizPZYBmLC4Jm52_wOBpeEVhRb_P3rvtBkI-7RpgKh21G0WpH1gkl44k-YYOYzHlB2-Mr5igFsBuAGq_Xdd1dy9PJ88kcC2mBHwy4WptzfYO3_3OKeFq5rTy-i-TbP2kEEZbf1fGDQ99KL448usiMvaROuUvYWp0siivPyZhpkM-Nhm8sH2nys9xhLlu4ITNHlAMAHnyI8gHTTAZaVmNjgugbyDb-6wqYVJl2HKNI6DY1lQYZaRpEoyp5kxFPzuzy99TSoz5pq_9a_kyaQuxWFIBCXhQ02Pj7HZyUuRYk6oNkasooiMn215cxD-4XEsiHvWWzvY-Qkxgd0BLVmBJD8P828u1glxiATg_7-e5t0j64a13jlDwDNs7Inw96CZE-pQauBXGAkiwDbQRUA9ubgWbqTkbMeVUN9IldAzr5r9FT3eLscLlhJiDLdO8RRJp8amm4UhfbFG-J4174yHQM4Im5mAtE-HNI4--jwn-Pi8PzV-f0LT-j84I4eqQsXwb8e80z5Rk3ojRUd9qBtHZnCaHYacLvpeMjjM_W7amTIDrN3qsNiXhEDTr9qm0bPs-XAaNDlzWCN9shaRJvL71nnAdIXR-Bh_YAbC55BWjdqMC68mWNrMxv5aVDBl-aTCr5Z08N7aNn7XzphqtW56K2LNwvGBgALzRcXI-3v6T6F35BbBD_cqEZK1BRvWVLkHQIcFY_sUWMz1j1RAlMsh4CwNeOQ3LRrBJpGVp6-SIvQ4AIL7qt3SVwkjwMVtT4Ha0CePSCc6WOMNpZyfAVqu10QI4i6R0VWC7wbKK3lmQwDTq3KxUrI_jCa6iiEvD6s-d_mtgMvK4W7SdxRNZceR1LYfOhfdux6qY3qgc6-CeVx5VLXvqYUwWUY1JVHda0N75-7cwACPF0YJB4QIOd-R7Nale3zOAYHybd_z_RadkXXdfRgZsv9ggT5KrJXbAvba9JfMEwOu47A46z08OBx-fhp2UIgefqOBGRtDNB-Ksl6OVtrQ813iR9bQa8XqbF6i20BThu3O9HYQTEunxdbI7VVct_ChBT14PuhxaAHyDNdUdManIcJlmCoZXYu7oL88iofGVdWPzOj26zV9x60yKLo7zfWcmnJr_mNafOlGvDXsA80CqrGW75DurEQVc-IgXcnMLb2pFILVJdKMM26RsT97T3agUGZVk6i21EydXvDpkPf4FN-Jpi4i6LNQ90DaKJQ7gx3on1CTA1dXKOuLjvaidrbEeMhJJ4jZ6FBMdL3y5HDbA7QRy_e9ezQE3nkWEd9FU5Sb-0TGEnjUCCMqO0k8oovFGLJelXlluSqdJzrOCbVwAxbMb3vkaK_iWwRveZw7dAxvLebl9AnR7-Ye3goZU4ZHlSmt17rQV2pSu1Psa1f_0dQkN8ErRebyKaLPIR0iW8z1aa2DhoeDB0JUsVD6o94-FSpUakF7G090K9BAizIB1Lv74eyubvqjjj-LMUxPd8IPqah6nUdIkubgmzO4IOEnT8zvGoZFBZMAt2L_8-kcKjv5uC7KV-wfgUDoqMGIvZjpVjW86mo0cvBj3vVLHzvXTBhigdxVGr1Y8oemdclRxjRtrzAeuT6MfonDk698PLPuWeFFgNfWZaa2TPIyvXjg2UA6CmnltSEe0HEwM5aV7wV4NPAwyd-PSMSobB5Iveax99Wp_7r5fnd7nH50-QaA3mglEupA_rD_EJdiyLUaZQx-jLt2J-fM1r2OZ9G_GF84y05C6TeDVlnTtVE4u-1yCFEWlKcE9nwiWnaviTwzdeajzDJlk3zYOeI2KCqRMc9DXLmhSiMH6nwerJATXpUn5qhaic97Tbcd26jp1aSts0JJQt02NQnAL9NYpk_qVYm8Omb0zlorJ2MIqytbrVoknZsqxlRIy4BzxvaxJfVkjZCkMmTtTkWhvGt_glFVRMxo97ynl9i4Bafl7hbbIlTft_H6J7sbdXsU1aTK6Oo3Ly78eQb6RKBOkw55zv5_TRLbdDQKM4L9RjtpqcMVG212LeB9vx8mA24_ItD9n10dqv-YRWTjEgnakL5PPkxNDjvMwbi0SdR18eCkMBnYCt8280EKxmzFip8uJC9x1NKmglBYjRLHdlXW8wSRL2wFSxb_PhCpkrn87E5LKEIO6DIA7qBNKoHiWzbVUUmZeGO0bLlhOZAE8Fa2u0ko-gwG4PzNQlsAkdZY6l9CxK86t1fdouDggy3cHoYsskZb531TmnDTe5lXOP4kcufZyPCIJ4M7mxY5kPZHUP0enp41fTFiUEJxt25tkHiFOSKOKFQfSP7ng9kP00KxUHtLokSaf7COVdvU83WzBNznqIlHT6KeBO8ghWqc8tg5ivSta3N7rWLtMDVZn_bzbb8cYiU35I8vmY1pkddKImCVkVYUOuFWALnxGz7u-QVw7GkZf0a8V7Pr_aKdzD9A3Fi7h6caEv8szjwp9w0D3PLWHhZHB2zYRUIcnlqvfLM4p3LrIWhZ195MKRHuVDNbRzvaC5gjfBLtVfr3_EAlMsBdFN2vIBazMm7NTwCCqto44_SYfg6WDyQCrUPP4hDwhAUDk5rquoA9FUbGsv5W7L9c0jw7YZM-A6XH8cmyt_DD3SToArPWNIgl89Ha0ihzKXQQP20fP95gnH0ZhzSaBVZh1zSXGGerAPcEbM132Arfr7Nt619emrqUBjqIimCsu1jp6LcKCeiECPzuXcFvcsN_cFmwUaOfBRYHEaR7x10vSOiXExfIb257RgVFECbl3JWHU_dG2v65tyfi2MuTgtik6FAQzbhBK0Ul2kB97Y9MF7FA85l2h95TPmOfcdPGKnsXkPigIEaZ-bxXWBGnmn5wT7Y36_hmplDSFNSgBQLdYRvdu-lmnW4xj43N389WsFRLqVT2F8JkrPrsIU0FRQtNxAWWv1O2Bl7_fGIlATvKz1acKB6QyH7V_8PXtRwxeRmPf8zbu9Oxs-wponapdu0gZ1ydbXEM06kjD9fVzh9GPKCjrcuXLoxhyNVjCa9JTR47eBd4pTU18ZgnCQUkngBQ0NSKAiY2fbh-qXh4FB-VMPRAxm6rDBhC_bvBgOSlvaL5Xs0-9RBYM9hh2JOXi4ezdAKAoXhD7xxCL4FXXeXbde4hn36FGxGgzIsaB880XUWTk&cid=CAASEuRovy-om35Ng1qS8llVxS8r2A&rfl=1%2Chttps%253A%252F%252Fwww.onmsft.com%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:44:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 371
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3140
x-xss-protection: 0
server: cafe
etag: 17163059639670574047
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 02 Dec 2021 15:44:53 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/ Frame 2E2F 24 KB
9 KB 12ms
12ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20211111/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:48:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 160
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9475
x-xss-protection: 0
server: cafe
etag: 15988442915344899701
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 02 Dec 2021 15:48:24 GMT

GET
H2 200 batchHandler.292de00282b644b2ec50.js Show response
cdn.intergient.com/pageos/1.6.29/ Frame CF53 3 KB
2 KB 9ms
9ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/batchHandler.292de00282b644b2ec50.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 225a5d44793400c62040e70a55fc77beed0a3cbc0d7ac361abbf4085392b1e20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 14:37:11 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:39 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:de92c4772058b0bc43087610c61d14a5/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 4434
etag: W/"de92c4772058b0bc43087610c61d14a5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: 67zM88YL5OZIz0HAe5rq_MoTpINgHq9JU-ZIJSFYXCBWYofaQNlLvg==

GET
H2 200 banner.json Show response
config.playwire.com/1023788/v2/websites/71908/ Frame CF53 21 KB
3 KB 10ms
10ms XHR
application/json 2600:9000:2057:5a00:1a:1459:5cc0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://config.playwire.com/1023788/v2/websites/71908/banner.json
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2057:5a00:1a:1459:5cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Cowboy /
Resource Hash: 949192cf915ba5e7aa5ee91f12efccc64db5f7f5c99ca44e9e6a7634c1a64428

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 22:59:58 GMT
via: 1.1 vegur, 1.1 d07eabeb1ed60c06da1457f35fb5c8c5.cloudfront.net (CloudFront)
vary: Accept-Encoding
age: 60666
x-cache: Hit from cloudfront
content-encoding: br
server: Cowboy
access-control-max-age: 1728000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: hw-country-code
cache-control: public, max-age=600
hw-country-code: DE
x-amz-cf-pop: FRA6-C1
x-amz-cf-id: cQU3rHtsjxAU7GMyAeDFqFsRbzfSVK_GvMLPSMTFhBlSmxC1DlLzTQ==

GET
H2 200 moatheader.js Show response
z.moatads.com/playwireprebidheader597261727146/ Frame CF53 214 KB
75 KB 20ms
20ms Script
application/x-javascript 2.18.235.40
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/playwireprebidheader597261727146/moatheader.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.18.235.40 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-235-40.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 8e662cd2ca55a4bddd132966304a69f7643154d359c97ab4850606922be42556

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:04 GMT
content-encoding: gzip
last-modified: Tue, 02 Nov 2021 14:45:26 GMT
server: AmazonS3
x-amz-request-id: P9CXSHBDCGRCHB6K
etag: "5e40994da788591853a03ad1379eff9b"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=43539
accept-ranges: bytes
content-length: 76349
x-amz-id-2: ZcNVvok1ZAEFpeE6S8Wxb2i2sxpjOeblPvh84A+t0v4JkQWjAKLl4/SFAo1HCtZxcyzhtnaWBcc=

GET
DATA 200
OK truncated
/ Frame CF53 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3131e5cc32f0402b4fc1137b12dc65c053fc3ae2de80955050f1f6eca08fff47

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 vendors~gdpr.f92225b828d740c7c57f.js Show response
cdn.intergient.com/pageos/1.6.29/ Frame 95E9 65 KB
17 KB 13ms
12ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/vendors~gdpr.f92225b828d740c7c57f.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a87d4c2682d10f0750f0e1142e25fce055f0ae596c7a277bbaf2427ddae146bc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 02:59:33 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:44 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:9b5e3fdd31d877679a5666fe44299ea9/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 46296
etag: W/"9b5e3fdd31d877679a5666fe44299ea9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: weHG6yx88p40kf4B30obCZ8BUmgXRPfi2R_pzTadwgJt9YCEoEZyUg==

GET
H2 200 gdpr.3ce8554fcbe8b97488e7.js Show response
cdn.intergient.com/pageos/1.6.29/ Frame 95E9 9 KB
3 KB 13ms
13ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/gdpr.3ce8554fcbe8b97488e7.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 99676824143e650821663a625e811e4b1f74ad095dd94e2ef134fc5dc3286aa9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 06:05:13 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:42 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:27934a360f2e8bf072d593df31290def/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 36938
etag: W/"27934a360f2e8bf072d593df31290def"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: QlIncCG3Zqh-Tcgskb84qgFey2TmzhBX1LokYozfr2CIFs404KeEcg==

GET
H2 200 aws-sdk-kinesis.min.js Show response
cdn.intergient.com/pageos/js/libs/ Frame 95E9 227 KB
63 KB 13ms
13ms Script
text/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/js/libs/aws-sdk-kinesis.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/batchHandler.292de00282b644b2ec50.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b41e0020ff5a4bec857828c37b9a425a5e0024aac1fb1519dd9cf4562f0681ee

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 23:06:28 GMT
content-encoding: br
last-modified: Thu, 04 Nov 2021 13:03:16 GMT
server: AmazonS3
age: 60277
etag: W/"dd4723e36a9cd5d1d04946ad79b9dfe6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: kW1lAiLsgeUt67XOYDSigB90hGCXw09axgoA1mHEY-P_IevQTdb-Hg==

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 37F5 80 KB
21 KB 8ms
8ms Script
application/javascript 2600:9000:211e:1400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 08:08:31 GMT
content-encoding: gzip
age: 4174954
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 3d58896f901dbeed449603f5d2b4d9f1.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-C2
content-type: application/javascript
x-amz-cf-id: fTCdMpYCA6ZtEPTPM7S-tarqajZ8CXffH9PBIxLswNfzXWaroQBMwA==

GET
H2 200 mon
pixel.adsafeprotected.com/ 43 B
216 B 35ms
35ms Image
image/gif 34.254.9.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=7529&campId=300x250&pubId=53576252&chanId=194640332&placementId=5502672901&pubCreative=138326616697&pubOrder=169870292&cb=1518585077&adsafe_par&impId=54a950f1-4887-11ec-93ca-024bf4a6d028&adsafe_url=https%3A%2F%2Fwww.onmsft.com%2F&adsafe_type=abdfq&adsafe_jsinfo=,id:949e54f2-6a29-e93a-47c9-bbaf125c915f,c:ukO9mu,sl:outOfView,em:true,fr:true,thd:1,mn:app17ie,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:465.2984.300.250,am:i,cc:465.2984.300.250,piv:0,obst:0,th:0,reas:l,br:u,abv:na,an:n,oam:0,scm:publ1.grpm1,nbld:0,mtim:112,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e*.7529%7C1e1%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1e*,pl:,rmeas:1,rend:1,renddet:DIV.qs.sn,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:131,oid:55cbff92-4887-11ec-9f5d-0289e6fd96ae,v:19.8.267,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.9.67 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-9-67.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: app16.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 sca.17.5.12.js Show response
static.adsafeprotected.com/ Frame 9DF0 80 KB
21 KB 9ms
8ms Script
application/javascript 2600:9000:211e:1400:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.12.js
Requested by: Host: www.onmsft.com
URL: https://www.onmsft.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:1400:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 08:08:31 GMT
content-encoding: gzip
age: 4174954
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 19 Aug 2021 16:31:24 GMT
server: AmazonS3
etag: W/"9304f57298c3834ff107ea7ccb547996"
vary: Accept-Encoding
x-amz-version-id: 9YodSBhG3Q8HTUbQ_WDUpcPK09tSZ5ja
via: 1.1 3d58896f901dbeed449603f5d2b4d9f1.cloudfront.net (CloudFront)
cache-control: max-age=315360000
x-amz-cf-pop: FRA56-C2
content-type: application/javascript
x-amz-cf-id: IC-pa2nziRW3TWoLd5cCA0A3zPi9TV2tREjjS5BrRqNzY9QIVFsA9g==

GET
H2 200 mon
pixel.adsafeprotected.com/ 43 B
215 B 31ms
31ms Image
image/gif 34.254.9.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.adsafeprotected.com/mon?anId=7529&campId=970x250&pubId=53576252&chanId=194640332&placementId=5502672901&pubCreative=138326195346&pubOrder=169870292&cb=111882097&adsafe_par&impId=54a950f0-4887-11ec-93ca-024bf4a6d028&adsafe_url=https%3A%2F%2Fwww.onmsft.com%2F&adsafe_type=abdfq&adsafe_jsinfo=,id:39e3e203-7da1-b793-f63f-537e17926895,c:ukO9mS,sl:inView,em:true,fr:true,thd:1,mn:app05ie,rg:ie,pt:1-2-3-4-5-6-7-8-9-10-11-12-13-14-15,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,br:u,abv:na,an:n,oam:0,scm:publ1.grpm1,nbld:0,mtim:141,fm:sP8cVTk+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,pl:,rmeas:1,rend:1,renddet:DIV.qs.sn,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,tt:jload,et:148,oid:55cc26e7-4887-11ec-9c5b-02bf2b86cc68,v:19.8.267,sp:1,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.254.9.67 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-254-9-67.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: app12.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
216 B 344ms
111ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9mT,pingTime:-8,time:149,type:l,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:149,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B7~100%5D,as:%5B7~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:sP8cVTk+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 332ms
111ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9nd,pingTime:0,time:169,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:169,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B27~100%5D,as:%5B27~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: dt07.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 vendors~gdpr.f92225b828d740c7c57f.js Show response
cdn.intergient.com/pageos/1.6.29/ Frame CF53 65 KB
17 KB 8ms
8ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/vendors~gdpr.f92225b828d740c7c57f.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a87d4c2682d10f0750f0e1142e25fce055f0ae596c7a277bbaf2427ddae146bc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 02:59:33 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:44 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:9b5e3fdd31d877679a5666fe44299ea9/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 46296
etag: W/"9b5e3fdd31d877679a5666fe44299ea9"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: 3u_Ez4TjwK9pvNDxs7o12HttNsqBre-q2O9dTaIB8qbDBDbtpAPLRA==

GET
H2 200 gdpr.3ce8554fcbe8b97488e7.js Show response
cdn.intergient.com/pageos/1.6.29/ Frame CF53 9 KB
3 KB 9ms
9ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/gdpr.3ce8554fcbe8b97488e7.js
Requested by: Host: cdn.intergi.com
URL: https://cdn.intergi.com/hera/tyche.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 99676824143e650821663a625e811e4b1f74ad095dd94e2ef134fc5dc3286aa9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 06:05:13 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:42 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943597/ctime:1635943597/gid:20/gname:staff/md5:27934a360f2e8bf072d593df31290def/mode:33188/mtime:1635943597/uid:501/uname:thomascreamer
age: 36938
etag: W/"27934a360f2e8bf072d593df31290def"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: IXMiGfuyxY7I0GUkQkYeRy9LElWQufStWP1EOtlZ9yAWiTxY1QNE4Q==

GET
H2 200 aws-sdk-kinesis.min.js Show response
cdn.intergient.com/pageos/js/libs/ Frame CF53 227 KB
63 KB 9ms
9ms Script
text/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/js/libs/aws-sdk-kinesis.min.js
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/batchHandler.292de00282b644b2ec50.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: b41e0020ff5a4bec857828c37b9a425a5e0024aac1fb1519dd9cf4562f0681ee

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 23:06:28 GMT
content-encoding: br
last-modified: Thu, 04 Nov 2021 13:03:16 GMT
server: AmazonS3
age: 60277
etag: W/"dd4723e36a9cd5d1d04946ad79b9dfe6"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: xbPkVNhxNtSp4dO3Vm-9pDvcR0fRGSAq77rEp9ANUrLKnYGPXfwzCw==

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 321ms
112ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=949e54f2-6a29-e93a-47c9-bbaf125c915f&tv=%7Bc:ukO9no,pingTime:-2,time:186,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:136,beZ:137,mfA:248,cmA:250,inA:250,inZ:254,prA:254,prZ:260,si:267,poA:267,poZ:282,cmZ:282,mfZ:282,loA:306,loZ:308,ltA:322,ltZ:322%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:300.250,dom:div%7D%7D,env:%7Bgca:true,cca:true,ccd:%7Bversion:1,uspString:1---%7D,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:l,w:300,h:250,t:130%7D%5D,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:186,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:130,wc:0.0.1600.1200,ac:465.2984.300.250,am:i,cc:465.2984.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B71~0%5D,as:%5B71~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e*.7529%7C1e1%7C1f.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1e*,rmeas:1,rend:1,renddet:DIV.qs.sn,slid:%5Bgoogle_ads_iframe_/4585/ns.onmsft/homepage_1,google_ads_iframe_/4585/ns.onmsft/homepage_1__container__,nsgpt-largerectangle-1,post-217264,main,primary,content,page%5D,sinceFw:54,readyFired:true%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 318ms
112ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9ns,pingTime:-2,time:184,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:129,beZ:130,mfA:271,cmA:271,inA:271,inZ:273,prA:273,prZ:275,si:278,poA:279,poZ:287,cmZ:287,mfZ:287,loA:300,loZ:300,ltA:313,ltZ:313%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:970.250,dom:div%7D%7D,env:%7Bgca:true,cca:true,ccd:%7Bversion:1,uspString:1---%7D,gca2:false%7D,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:184,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B42~100%5D,as:%5B42~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn,slid:%5Bgoogle_ads_iframe_/4585/ns.onmsft/homepage_0,google_ads_iframe_/4585/ns.onmsft/homepage_0__container__,nsgpt-billboard-1,zd-leaderboard%5D,sinceFw:34,readyFired:true%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 cmp.js Show response
cdn.intergient.com/pageos/1.6.29/cmp/ Frame 95E9 318 KB
81 KB 9ms
9ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/cmp/cmp.js?version=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/gdpr.3ce8554fcbe8b97488e7.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3a9430686f271be35c5027e71e6c54b6830099c37346affc7a2219dad9824dd8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 02:27:29 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:42 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943596/ctime:1635943596/gid:20/gname:staff/md5:7ee1fe36c67989613ab3a8da064f82b4/mode:33188/mtime:1635943596/uid:501/uname:thomascreamer
age: 48835
etag: W/"7ee1fe36c67989613ab3a8da064f82b4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: I2I66Zjs6qbFzfg894DeBw8naGY4YGfCc_Za6BLxuaWkpkpwxiSXTg==

GET
H2 200 index.html Show response
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 5 KB
2 KB 34ms
10ms Document
text/html 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_obb_rendering_lib_200_275.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aac21a310e8bbfe3a731c58bc2995d78b8cdc649e401893c9c18f0bc0ea4980a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 1503
date: Tue, 16 Nov 2021 23:10:21 GMT
expires: Wed, 16 Nov 2022 23:10:21 GMT
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 146443
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2E2F 0
571 B 108ms
63ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst0TEUqvdUJLDK7EXyIy_6-kVN0MXFtTcjCj86fU3HJGT6lFyZ_Hc4gI8miAZNIOHMJaf99H-QTEmyy4IB_jxWCPkTBwKJ1LbH21HDABD4fzfgxlUpepYnU1xAkKO_Bxt-FF-ufDTipeL7jyo80_HilnFgNPo1Q87HYztyE7RQCujUT1mxRSozWqPKktM4Xtxv4ivkbwQ6H_zbo-8d1m20XiIzX1isvgk3i1YnyBUSdo5KN7Lhod4O3bkRkBndVQpCIsUS7AFjFoSg9stadpZhouRIM3E2wAJlhy13qImi4ACsb9j8HaP9lO_53nJweyLo46PkkAS81BoUVFSd6qxnBaWVbeFLU2dr5y62X5PQsZ9xg56LXp0un7yFOZQ_ZFAMLP6dlwQagW_d5Xoms7uls_4GRSU7nk5lQiurmUXMygQ1U0JZP-5tKUFfCccEKWo00a9FfB9zb68CXUEeHJe_xGWGl2fost8QBSSyEymwBFCf3Go-Wlx4FhxQoy8RJMGLYrAhcISRt9LVHQgP3uFk9pubvoxc26TWlGT0OquvCxTq9J5Ue_aRSRZe9_qZYRyzqnCKI7CWGcxmj-rwb-mq-2kHN_lQ92kpcpJ0fyqkM3juR6VF4dW7wLdpshzJ2zGStfqVONJG1p8Qgi0lX3ITCy7QuU9RwJU1ftq_IVY250is84hG28eb05vp_W8evnhGX2x3UsQIt9FO2zhPqMYBNnBp14iulGKf1rluhPjDApSjQWQBnJeB-SO1dvllge2JbHQo55YONMQcH2MLSqO68GBPIqVrZlZEo7s91-mr0jt3GjfPm2zP6_pSxlam4NqguEM3zuGG1c_oaP1s5gXgw3EyIrhdUpnvmFiFE6VoyRKydoe1NO37FqDvqapPANVnpkYUL-I4BgGNHP12wMI9Lb6ZnNeoCq65PhGwRTJ1Vc9t2kEXoJQ2T-hHhnarTk3krXXw0r-nvSNAG--YGDSDg4V54TPxxuBxrRmjwS1mKzS2n-xCrwPIpMhPsLXO3ArNLJuufD1VDSfpKtC_wtG6sR-VWROu2Jp6I0EH32t-D-e__bxTw6MCVTjksaCoPyD3vactdKgvjYU2sULTtsBSoknE7xmgVDXmz5PUiaIJqMmEdb0vIxyQw9qFHBsvqsCJKOekMba711HgYNyFheWBOB8z3wElKfRh0ZD-FZinG3fyTCD1kYT2kWV7kRFLj0c2vDagnxqQHXs2W148HKok3qngUqufY-setuaTn31dkhjia_i6UnLYQMST6xab6ALYwQDAJCqwCkeH4NUidxPfrPdvQqtZB35xw4UO6hIZM-X3bpxVWWwILMuHbaWUomOPMUolxCsnonz4cE2A1Bf01XQ&sai=AMfl-YSEyWFXUs_t3Xw1jZRUBQP9Xvs2MT-uKet6Bmqrp57XVPkXOaqdAokrQx_uH8FwyYxqurQ7WqqzaWfe873zqAJF3npsg_POMsf2OnZXMVkN2nxnYR1HuhVTpIYbDcsubyHIzc_X_agw4J9jiwpnvUfL3M0Jxv46-kQQf8lN-62x3-PkweWUuVQ&sig=Cg0ArKJSzM6Tn38zlLkHEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=143&cbvp=1&cstd=140&cisv=r20211111.42661&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 18 Nov 2021 15:51:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 2E2F 41 KB
15 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:31:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 87557
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 17 Nov 2022 15:31:47 GMT

GET
H2 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame BD4A 1 KB
844 B 11ms
10ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Thu, 18 Nov 2021 13:26:12 GMT
expires: Fri, 19 Nov 2021 13:26:12 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 8692
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 2E2F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 353dd5e5024f0848ad4c84c1675cdef2619a67e9db1a562046982a6463ba8a81

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 cmp.js Show response
cdn.intergient.com/pageos/1.6.29/cmp/ Frame CF53 318 KB
81 KB 19ms
19ms Script
application/javascript 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/pageos/1.6.29/cmp/cmp.js?version=1
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/gdpr.3ce8554fcbe8b97488e7.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3a9430686f271be35c5027e71e6c54b6830099c37346affc7a2219dad9824dd8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 02:27:29 GMT
content-encoding: gzip
last-modified: Wed, 03 Nov 2021 12:46:42 GMT
server: AmazonS3
x-amz-meta-s3cmd-attrs: atime:1635943596/ctime:1635943596/gid:20/gname:staff/md5:7ee1fe36c67989613ab3a8da064f82b4/mode:33188/mtime:1635943596/uid:501/uname:thomascreamer
age: 48835
etag: W/"7ee1fe36c67989613ab3a8da064f82b4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 106758604a7f1ae0fa6678cd3d828d62.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: INloYTdW-2QBoQyr0ODspLp6aJI2kgAxQsZgi5-uNZG4thBxO1G7GA==

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DD8B 22 KB
8 KB 27ms
27ms Document
text/html 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Wed, 17 Nov 2021 15:43:53 GMT
expires: Thu, 17 Nov 2022 15:43:53 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 86831
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 styles.css
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 3 KB
778 B 28ms
27ms Stylesheet
text/css 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

013d915dd062c2970864ce58149715bbd5b4e6ac2dfc21531badb6d6f957a619

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 12 Nov 2021 08:07:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 546237
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 675
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 12 Nov 2022 08:07:07 GMT

GET
H2 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/2.0.2/ Frame AF8B 113 KB
34 KB 108ms
30ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/2.0.2/TweenMax.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

009bf00d3831fb62595adb20e170ed288d8a157493fb6028b1888b05875ed8f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:04 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1120328
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 33806
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1c56a"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gWI%2FbzrUmUSD4e%2FJmXldBdiO2DGx9IorntP937KTE9A8mDXuQalKvCmJhAWv244SGbXMdvR1zCCU%2Bn7skCvXrYeGElp7brh8ZS9ENfpNumBI2IFYSsVW%2Fx0Z4z3SHJ17Rke4Bpxyp0gWK3jYr0U2Xdnl"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6b025bac3d9259b3-MXP
expires: Tue, 08 Nov 2022 15:51:04 GMT

GET
H2 200 main.js Show response
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 10 KB
3 KB 31ms
30ms Script
application/x-javascript 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7fb740dab4620f2d5de41d2d9f0bcb6028e02cb761490bce0c88a14c1a907727

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 15:59:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 85897
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2469
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Nov 2022 15:59:27 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 95E9 0
0 57ms
57ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjss2eOP1uW5C2xIdzvcoZnNbj_JL9Q8e3aRD5XTRwlsdcG5hIy4tA18zbYAVhB4WDPpJWM9LzIIkvJhRapk56tBg1bXAyjOQwqDcKwry4G1G80TXjhliRjIsTtF2hrEhhevBjh8K311d_0ndTThuDoTuCBkkWMAOGSRs5YNTjp0JP7tlWIIhjrJ45IKYTDhtxM3wRMAAMbvL7PlIRKI4W0fAD8TD3qvhyHQGIGZjZlwi05p4qxoug8tTcgXkMH62-4DwxHp9FwRANsZkMqqHHmtGd3R08Hcvu257zvHb8-eJbEAMWB6LI1lwEzsK&sig=Cg0ArKJSzF0jqkEsxDoHEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:04 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 18 Nov 2021 15:51:04 GMT

GET
H2 200 vendor-list.json Show response
cdn.intergient.com/tcf/v2/ Frame 95E9 294 KB
34 KB 123ms
72ms XHR
application/json 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/tcf/v2/vendor-list.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/cmp/cmp.js?version=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: be9c20cc4a0dacfbb9f19ba5c679327b063678f1568ccf7350838baf3cffe49a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 04:38:12 GMT
content-encoding: br
last-modified: Tue, 16 Nov 2021 14:55:59 GMT
server: AmazonS3
age: 40372
etag: W/"c3f14909d8414ece2adec9101615e974"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 3000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: Biah19tKakUa1PtIcJzzZ0oYB71TAPHKfdNpsWVZfDo-iYmqy2RSpg==
via: 1.1 9570c3a1725c20e6faed117bbb74223b.cloudfront.net (CloudFront)

GET
H2 200 vendor-list.json Show response
cdn.intergient.com/tcf/v2/ Frame 95E9 294 KB
34 KB 125ms
84ms Fetch
application/json 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/tcf/v2/vendor-list.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/cmp/cmp.js?version=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: be9c20cc4a0dacfbb9f19ba5c679327b063678f1568ccf7350838baf3cffe49a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 04:38:12 GMT
content-encoding: br
last-modified: Tue, 16 Nov 2021 14:55:59 GMT
server: AmazonS3
age: 40372
etag: W/"c3f14909d8414ece2adec9101615e974"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 3000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: acfLM4UyZUtHeqoXmHKgyW_GxGv7lsMWcCp1D2YEn8hcvwDA-osfMA==
via: 1.1 9570c3a1725c20e6faed117bbb74223b.cloudfront.net (CloudFront)

GET
H2 200 additional-consent-providers.csv Show response
cdn.intergient.com/tcf/v2/ Frame 95E9 156 KB
46 KB 113ms
72ms XHR
text/csv 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/tcf/v2/additional-consent-providers.csv
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/cmp/cmp.js?version=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 778b9c92e72de3d33310a1ebdddf04ca1e335f0e64829f5ac55b1719d5e135d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 07:40:12 GMT
content-encoding: gzip
last-modified: Wed, 03 Feb 2021 19:20:01 GMT
server: AmazonS3
age: 29452
etag: W/"a7229fb4455a9d3020b1a559e0c6fce5"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: text/csv
access-control-allow-origin: *
access-control-max-age: 3000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: uflH5bvPoLG2CnFYDtasneEIgD0mkDAZjlK1mvvvJowlm12LHNJXig==
via: 1.1 9570c3a1725c20e6faed117bbb74223b.cloudfront.net (CloudFront)

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame BD4A
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESELAJHXCgNxPWNWy9pK6gI1U&google_cver=1&google_push=AYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bL...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELAJHXCgNxPWNWy9pK6gI1U&google_cver=1&google_push=AYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0...

43 B
427 B

215ms
198ms

Image
image/gif

2606:4700::6812:c05
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELAJHXCgNxPWNWy9pK6gI1U&google_cver=1&google_push=AYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bLg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bLg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:c05 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6b025bae38303745-MXP
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
content-type: image/gif; charset=utf-8
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1292
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6b025bac7c323745-MXP
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESELAJHXCgNxPWNWy9pK6gI1U&google_cver=1&google_push=AYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bLg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAYg5qPKxdwh2T_r5HZlxSyZLap9siyrUKmyKFlrZbeGKboeBodP8AmgQjn_4Bo6KF3usqmv8vUXtLAnCZF6r8nmqmkJXwODqtU0bLg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame BD4A 70 B
265 B 137ms
45ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEAtLG2rOb8H-CKfnczZTg2M&google_cver=1&google_push=AYg5qPIkjNe-rMISETQymswB4RSYSQYZprDokirZqHilMDM6of3nCaZ-OHpggr3D_batuja60DFXkFsmPMKuEujozaUpqrGrMgQw4w
Requested by: Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4A
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESELr0j8BT9s0ECJ1NcQ-N0t0&google_cver=1&google_push=AYg5qPJp3oLGMroJIuHtxzqHo-Eb7HPJcmCFKDgTE6ISfWPRh8ZL-Ri1J3R5uC-gEliF-Q0TucDQY6imhtsk7B5bOxAUcNR...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJp3oLGMroJIuHtxzqHo-Eb7HPJcmCFKDgTE6ISfWPRh8ZL-Ri1J3R5uC-gEliF-Q0TucDQY6imhtsk7B5bOxAUcNRAO1tfIg&google_hm=Mzk3MTkyMTUwNTUxNjM5...

170 B
188 B

38ms
37ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJp3oLGMroJIuHtxzqHo-Eb7HPJcmCFKDgTE6ISfWPRh8ZL-Ri1J3R5uC-gEliF-Q0TucDQY6imhtsk7B5bOxAUcNRAO1tfIg&google_hm=Mzk3MTkyMTUwNTUxNjM5MDEwNw%3D%3D

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 18 Nov 2021 15:51:04 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AYg5qPJp3oLGMroJIuHtxzqHo-Eb7HPJcmCFKDgTE6ISfWPRh8ZL-Ri1J3R5uC-gEliF-Q0TucDQY6imhtsk7B5bOxAUcNRAO1tfIg&google_hm=Mzk3MTkyMTUwNTUxNjM5MDEwNw%3D%3D
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4A
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEEm1y7Klc-JOremKAL1J794&google_cver=1&google_push=AYg5qPI6GM9YZ2GD3e_ATkZUWTuZcZzsVpOaF9Ljnr3C5ALKE3aanMofoeQIQP2Z3l9450s-m4Pw5QRT...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEEm1y7Klc-JOremKAL1J794&google_cver=1&google_push=AYg5qPI6GM9YZ2GD3e_ATkZUWTuZcZzsVpOaF9Ljnr3C5ALKE3aanMofoeQIQP2Z3l9450s-m4P...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzIwNTA2NjE2NTA4MzM1NDY1MQ&google_push=AYg5qPI6GM9YZ2GD3e_ATkZUWTuZcZzsVpOaF9Ljnr3C5ALKE3aanMofoeQIQP2Z3l9450s-m4Pw5Q...

170 B
188 B

36ms
36ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzIwNTA2NjE2NTA4MzM1NDY1MQ&google_push=AYg5qPI6GM9YZ2GD3e_ATkZUWTuZcZzsVpOaF9Ljnr3C5ALKE3aanMofoeQIQP2Z3l9450s-m4Pw5QRT5UBneYVLI35shqFydvIbag

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NzIwNTA2NjE2NTA4MzM1NDY1MQ&google_push=AYg5qPI6GM9YZ2GD3e_ATkZUWTuZcZzsVpOaF9Ljnr3C5ALKE3aanMofoeQIQP2Z3l9450s-m4Pw5QRT5UBneYVLI35shqFydvIbag
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame BD4A
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEBHdEFK6TNOp9VUI0yk_gQA&google_cver=1&google_push=AYg5qPLrukRstNUMYO8XWHntHXmY8xcM68T4_aMJsNunEVS4Ea_fNIGxcpqmotBsEqlVPUtPpstY6Fs2qZI5vzrbssxUXexSp357
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLrukRstNUMYO8XWHntHXmY8xcM68T4_aMJsNunEVS4Ea_fNIGxcpqmotBsEqlVPUtPpstY6Fs2qZI5vzrbssxUXexSp357&google_hm=tgUTnL35i-C_-VE5SPUb3A==

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLrukRstNUMYO8XWHntHXmY8xcM68T4_aMJsNunEVS4Ea_fNIGxcpqmotBsEqlVPUtPpstY6Fs2qZI5vzrbssxUXexSp357&google_hm=tgUTnL35i-C_-VE5SPUb3A==

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:03 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLrukRstNUMYO8XWHntHXmY8xcM68T4_aMJsNunEVS4Ea_fNIGxcpqmotBsEqlVPUtPpstY6Fs2qZI5vzrbssxUXexSp357&google_hm=tgUTnL35i-C_-VE5SPUb3A==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-request-id: 0ear65n74p864l4m2ptgjdp85r8kgmi0

GET

pixel
cm.g.doubleclick.net/ Frame BD4A
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E...

0
0

GET
H2 200 dot.gif
s0.2mdn.net/ Frame BD4A 43 B
175 B 27ms
26ms Image
image/gif 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEO4Mv0TPey1hSPvECiP-87g&google_cver=1&google_push=AYg5qPLPCCjd9Vt1Ft9vtLtVEdRqafdVCNuBtxbNrkseS5oBNEDVPwjtKmjJ8pSf5-CxhTARhD1is6TJmV6INWMEjHGv7gPLNwr92ps

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 19 Nov 2021 15:51:04 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame BD4A 0
12 B 37ms
36ms Image
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JrMbwT04w49bHoXSt1z-93dplxEcEDtwieI4Ar5-UdnXYos0cMzC-4hJnjt_knLthXsnzmwA

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame CF53 0
0 44ms
43ms Fetch
image/gif 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsut1cgE8OQYeWoxMrKoZu_j0WJox3nIquzdvkh8Xk1gHncINw73bVGVhedr4xNVdanSXBKsx2-WidGEwoJlYt3Ew4hLyGl59CIOi2v2StEaZqn6iHUm4IxVSfrqEXEuclXLLFRoc5t2s1Y5jgBaqFGnJ2PDq3blpLJ01KJBRviFcy4um6IYbzr6cAxPQ07KowoQGqKetTH39gdNPuKymmxwRJSsbQLmBAAijgME8KmLFvbG3KTtQwAZmXjYJRH10yGaDxmeWILm--V4DydbUywkN6Tr6BCCeDEdEwqf00QnfVmC-QbLhUYKYtC3&sig=Cg0ArKJSzJoMEPH2Q93-EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:04 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Thu, 18 Nov 2021 15:51:04 GMT

GET
H2 200 vendor-list.json Show response
cdn.intergient.com/tcf/v2/ Frame CF53 294 KB
34 KB 70ms
69ms XHR
application/json 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/tcf/v2/vendor-list.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/cmp/cmp.js?version=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: be9c20cc4a0dacfbb9f19ba5c679327b063678f1568ccf7350838baf3cffe49a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 04:38:12 GMT
content-encoding: br
last-modified: Tue, 16 Nov 2021 14:55:59 GMT
server: AmazonS3
age: 40372
etag: W/"c3f14909d8414ece2adec9101615e974"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 3000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: 2WuswAhy6uFkJlrP9HrDzj1FPm_pzZJSzspQC7pxC4nXta4ogzmc8Q==
via: 1.1 9570c3a1725c20e6faed117bbb74223b.cloudfront.net (CloudFront)

GET
H2 200 vendor-list.json Show response
cdn.intergient.com/tcf/v2/ Frame CF53 294 KB
34 KB 72ms
72ms Fetch
application/json 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/tcf/v2/vendor-list.json
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/cmp/cmp.js?version=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: be9c20cc4a0dacfbb9f19ba5c679327b063678f1568ccf7350838baf3cffe49a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 04:38:12 GMT
content-encoding: br
last-modified: Tue, 16 Nov 2021 14:55:59 GMT
server: AmazonS3
age: 40372
etag: W/"c3f14909d8414ece2adec9101615e974"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-max-age: 3000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: fv4739YQvkld6waXLmgbeWjoXYb8tCmzq0b4RKnu45XK7xaC7MTB1g==
via: 1.1 9570c3a1725c20e6faed117bbb74223b.cloudfront.net (CloudFront)

GET
H2 200 additional-consent-providers.csv Show response
cdn.intergient.com/tcf/v2/ Frame CF53 156 KB
46 KB 74ms
74ms XHR
text/csv 2600:9000:206f:4c00:12:4abd:d340:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.intergient.com/tcf/v2/additional-consent-providers.csv
Requested by: Host: cdn.intergient.com
URL: https://cdn.intergient.com/pageos/1.6.29/cmp/cmp.js?version=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:4c00:12:4abd:d340:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 778b9c92e72de3d33310a1ebdddf04ca1e335f0e64829f5ac55b1719d5e135d8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 07:40:12 GMT
content-encoding: gzip
last-modified: Wed, 03 Feb 2021 19:20:01 GMT
server: AmazonS3
age: 29452
etag: W/"a7229fb4455a9d3020b1a559e0c6fce5"
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
content-type: text/csv
access-control-allow-origin: *
access-control-max-age: 3000
x-cache: Hit from cloudfront
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: 4U2CvF8KIb7pgnU2U1Fk8bNE-YCYZW0JdpnDWPbmggEDjBWp_HrnNA==
via: 1.1 9570c3a1725c20e6faed117bbb74223b.cloudfront.net (CloudFront)

GET
H2 200 W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response
pagead2.googlesyndication.com/bg/ Frame DD8B 35 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 06:37:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33232
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13296
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 18 Nov 2022 06:37:12 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 144ms
142ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=949e54f2-6a29-e93a-47c9-bbaf125c915f&tv=%7Bc:ukO9ry,time:444,type:e,env:%7Bar:self.0%7D,es:0,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:0,o:444,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:130,wc:0.0.1600.1200,ac:465.2984.300.250,am:i,cc:465.2984.300.250,piv:0,obst:0,th:0,reas:l,bkn:%7Bpiv:%5B328~0%5D,as:%5B328~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e*.7529%7C1e1%7C1f.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1e*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: dt35.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 140ms
139ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9rC,time:442,type:e,env:%7Bar:self.0%7D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:442,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B300~100%5D,as:%5B300~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:0,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: dt37.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 background.jpg
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 30 KB
30 KB 21ms
17ms Image
image/jpeg 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/background.jpg

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f3d00155801e6b15fb665f88e1a32a7e171bcdd8a69c80eaf3214ebf12765bd5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 11:00:03 GMT
x-content-type-options: nosniff
age: 190261
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30248
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 11:00:03 GMT

GET
H2 200 h1.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 1 KB
2 KB 36ms
31ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/h1.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4580416002c331987b7fd1851f5ea1833e19b334f36246f5770b3f453247fc58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 23:01:05 GMT
x-content-type-options: nosniff
age: 146999
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1506
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 23:01:05 GMT

GET
H2 200 h2.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 2 KB
2 KB 35ms
30ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/h2.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

623ef51142e247565d210522bf42c0e5057cd44b3c2097a12d77fad98384cf50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 10:59:25 GMT
x-content-type-options: nosniff
age: 103899
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1968
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Nov 2022 10:59:25 GMT

GET
H2 200 h3.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 2 KB
2 KB 36ms
31ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/h3.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b864352149b314faf27427a04f4ac274938496f8c4513aaed4f12df475bfedca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 20:12:20 GMT
x-content-type-options: nosniff
age: 157124
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1647
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 20:12:20 GMT

GET
H2 200 h4.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 1 KB
1 KB 37ms
32ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/h4.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

86fbfabe474a7a211f25f226cb28431b81d2cdea2900203c1532fcf572423c3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 05:36:51 GMT
x-content-type-options: nosniff
age: 209653
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1135
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 05:36:51 GMT

GET
H2 200 h5.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 2 KB
2 KB 61ms
57ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/h5.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

130a9738dafedc6ce6c52b9def9a06df21b97b6b1f46175f1ef8315bd3975ef6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 11:01:39 GMT
x-content-type-options: nosniff
age: 103765
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2240
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Nov 2022 11:01:39 GMT

GET
H2 200 motiv01.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 42 KB
42 KB 37ms
32ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/motiv01.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9e4b6aece572af3dfffd45e4537d2cc2b4bd25125acfcbbe1b8c9b4c6394afa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 20:08:03 GMT
x-content-type-options: nosniff
age: 157381
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42599
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 20:08:03 GMT

GET
H2 200 motiv02.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 27 KB
27 KB 44ms
40ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/motiv02.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f05d95a46d0f6c095d27ff0f82251f12a6bca239b9bfaf7b956ef64c4cfbd826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 12 Nov 2021 06:36:31 GMT
x-content-type-options: nosniff
age: 551673
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27542
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 12 Nov 2022 06:36:31 GMT

GET
H2 200 motiv03.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 37 KB
38 KB 51ms
47ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/motiv03.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f25ceacfdda3e11632b251b866093d8f0d934e6ba51a539015e5e9a6652cc48d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 11:23:49 GMT
x-content-type-options: nosniff
age: 188835
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38328
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 11:23:49 GMT

GET
H2 200 stoerer01.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 872 B
966 B 59ms
56ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/stoerer01.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c29a7fe1caaf6c6bf467478279396da9dd1cdc2fb7ab0d4d48fbfff91778cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 23:23:45 GMT
x-content-type-options: nosniff
age: 145639
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 872
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 23:23:45 GMT

GET
H2 200 stoerer02.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 872 B
965 B 61ms
57ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/stoerer02.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b8bd60cfe92807d6cff14f0283a8341fe276c34d97384f8255de10176764cc04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 17 Nov 2021 06:00:19 GMT
x-content-type-options: nosniff
age: 121845
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 872
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 17 Nov 2022 06:00:19 GMT

GET
H2 200 siegel.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 4 KB
4 KB 60ms
56ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/siegel.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52441c4972364be6eea1460da73f37a3eb442169c2766696d4e82044a22f3564

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 11:23:20 GMT
x-content-type-options: nosniff
age: 188864
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4176
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 11:23:20 GMT

GET
H2 200 logo.png
s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/ Frame AF8B 4 KB
4 KB 57ms
54ms Image
image/png 2a00:1450:4001:801::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/logo.png

Requested by

Host: 90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
URL: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9841dd925aeeeeb4001bd50277203f34f2681f2fd8afb321e845aba54cfb0146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1113601056338963709/funk_202110_unlimited-LTE_300x600/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Tue, 16 Nov 2021 19:59:00 GMT
x-content-type-options: nosniff
age: 157924
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4240
x-xss-protection: 0
last-modified: Fri, 08 Oct 2021 12:52:11 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 16 Nov 2022 19:59:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2E2F 0
23 B 86ms
59ms Ping
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst0TEUqvdUJLDK7EXyIy_6-kVN0MXFtTcjCj86fU3HJGT6lFyZ_Hc4gI8miAZNIOHMJaf99H-QTEmyy4IB_jxWCPkTBwKJ1LbH21HDABD4fzfgxlUpepYnU1xAkKO_Bxt-FF-ufDTipeL7jyo80_HilnFgNPo1Q87HYztyE7RQCujUT1mxRSozWqPKktM4Xtxv4ivkbwQ6H_zbo-8d1m20XiIzX1isvgk3i1YnyBUSdo5KN7Lhod4O3bkRkBndVQpCIsUS7AFjFoSg9stadpZhouRIM3E2wAJlhy13qImi4ACsb9j8HaP9lO_53nJweyLo46PkkAS81BoUVFSd6qxnBaWVbeFLU2dr5y62X5PQsZ9xg56LXp0un7yFOZQ_ZFAMLP6dlwQagW_d5Xoms7uls_4GRSU7nk5lQiurmUXMygQ1U0JZP-5tKUFfCccEKWo00a9FfB9zb68CXUEeHJe_xGWGl2fost8QBSSyEymwBFCf3Go-Wlx4FhxQoy8RJMGLYrAhcISRt9LVHQgP3uFk9pubvoxc26TWlGT0OquvCxTq9J5Ue_aRSRZe9_qZYRyzqnCKI7CWGcxmj-rwb-mq-2kHN_lQ92kpcpJ0fyqkM3juR6VF4dW7wLdpshzJ2zGStfqVONJG1p8Qgi0lX3ITCy7QuU9RwJU1ftq_IVY250is84hG28eb05vp_W8evnhGX2x3UsQIt9FO2zhPqMYBNnBp14iulGKf1rluhPjDApSjQWQBnJeB-SO1dvllge2JbHQo55YONMQcH2MLSqO68GBPIqVrZlZEo7s91-mr0jt3GjfPm2zP6_pSxlam4NqguEM3zuGG1c_oaP1s5gXgw3EyIrhdUpnvmFiFE6VoyRKydoe1NO37FqDvqapPANVnpkYUL-I4BgGNHP12wMI9Lb6ZnNeoCq65PhGwRTJ1Vc9t2kEXoJQ2T-hHhnarTk3krXXw0r-nvSNAG--YGDSDg4V54TPxxuBxrRmjwS1mKzS2n-xCrwPIpMhPsLXO3ArNLJuufD1VDSfpKtC_wtG6sR-VWROu2Jp6I0EH32t-D-e__bxTw6MCVTjksaCoPyD3vactdKgvjYU2sULTtsBSoknE7xmgVDXmz5PUiaIJqMmEdb0vIxyQw9qFHBsvqsCJKOekMba711HgYNyFheWBOB8z3wElKfRh0ZD-FZinG3fyTCD1kYT2kWV7kRFLj0c2vDagnxqQHXs2W148HKok3qngUqufY-setuaTn31dkhjia_i6UnLYQMST6xab6ALYwQDAJCqwCkeH4NUidxPfrPdvQqtZB35xw4UO6hIZM-X3bpxVWWwILMuHbaWUomOPMUolxCsnonz4cE2A1Bf01XQ&sai=AMfl-YSEyWFXUs_t3Xw1jZRUBQP9Xvs2MT-uKet6Bmqrp57XVPkXOaqdAokrQx_uH8FwyYxqurQ7WqqzaWfe873zqAJF3npsg_POMsf2OnZXMVkN2nxnYR1HuhVTpIYbDcsubyHIzc_X_agw4J9jiwpnvUfL3M0Jxv46-kQQf8lN-62x3-PkweWUuVQ&sig=Cg0ArKJSzM6Tn38zlLkHEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=396&vt=11&dtpt=253&dett=3&cstd=140&cisv=r20211111.42661&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.&adurl=

Requested by

Host: www.onmsft.com
URL: https://www.onmsft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:04 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 2E2F 7 KB
5 KB 30ms
29ms XHR
application/json 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=latest&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_obb_rendering_lib_200_275.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

afff706f1439f94de9b30ff01e6fc0a02c856c2d28a20cebf14b6f8adef33593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 18 Nov 2021 15:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5420
x-xss-protection: 0

POST
H2 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame B4E6 28 B
342 B 54ms
54ms XHR
application/json 2a00:1450:4001:828::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/68e11abe/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 0
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/videoseries?list=PLX6ChvO4t9b5Fq8qwQpKQgCTIrgduCx6M
X-YouTube-Client-Version: 1.20211116.01.00
X-YouTube-Time-Zone: Etc/Unknown
X-Goog-Visitor-Id: CgtzUm1Ia0xyTnVKRSjl7NmMBg%3D%3D
X-YouTube-Ad-Signals: dt=1637250662035&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C313%2C201&vis=1&wgl=true&ca_type=image

Response headers

date: Thu, 18 Nov 2021 15:51:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Thu, 18 Nov 2021 15:51:04 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 2E2F 17 KB
6 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:80f::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_obb_rendering_lib_200_275.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 15:51:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Thu, 18 Nov 2021 15:51:04 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 108ms
107ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=949e54f2-6a29-e93a-47c9-bbaf125c915f&tv=%7Bc:ukO9ts,pingTime:-10,time:562,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85NS4wLjQ2MzguNTQgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1637250664501%7C%7C130e5e1a3f009f9fc9450119a503a5f5%7C%7C9ceebc4ad83ababb94d4029b4dca4e66%7C%7C0f8e68c6dcbe80591ac84dd36c7c6367%7C%7Cf654a20e0b670354866deb9cafae1cdc%7C%7Cac80d24056f0c99bb924d26d5c8dec13%7C%7C4222c926a71ce88e21437202f7e25b2b%7C%7C55c1941ca148e5e86e75bcefeedbbbd1%7C%7C1629390669%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-server-name: dt30.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js Show response
pagead2.googlesyndication.com/bg/ Frame 68C1 35 KB
13 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/W74_wbIuhH6bObXj0uCjode8PwiBrxgOKnAqo6ShAmY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 18 Nov 2021 06:37:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33232
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13296
x-xss-protection: 0
last-modified: Mon, 08 Nov 2021 11:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 18 Nov 2022 06:37:12 GMT

GET
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DD8B 0
58 B 53ms
53ms Image
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BuHNEZ3aWYcvXOI_s3wObg7KgBwAAAAA4AeAEAg&bg=!i4iliMzNAAZQLpa_UC47ACkAdvg8Ws1aX42xfegR5K1rkvUDFBhIL0I0FV7reakxYw-8OlurJaHnkwIAAAFtUgAAABRoAQeZAwEcPoEfCSH2qCowIvAdVQTdw48R6A3CSjX5CsNPdfcrf1O-5asy61PWtkEnyyoUJ_OhhEuG7Z1phNqaK2CK7H-IrX6z4Bz3kmCyVb6b0zA4S7uehG-SEpW94EXMole9Elncy8StcWgqZ-PRmr4jhR4LJL6wGCpX1zyXErWxvk_k07ohZzdMrmdbU-se5wZ6jp7-4YDjOdsg-JVOx83G7mozwjrR1tu4gBVu5YFJWmv7JRpYG2FVl7UWOZJ-UdP0SmZZA1TCUqKdpE-5G1hKhCcMw7mTJGcWzDaOZPiOS_0o6JciwF50-hIhAf3ik2ekVZ7wBK5LkgDlL3JzbL75AaHfHymEzhnGSddKnAUhiZHTCX9ZnzuvA5l2Lcpc-AMPKVM0egqfGUyRoqCQNO0mJ940LS92o2bm9QEeJFTLMo6UiMgNJ-uXkjHi3dYU0-zhrQdJ-Bdw8vsvOIcSO4QneD11BTuMJeAvzBkcIGKPagm9yKxWgIjC49IvguB42moo_Wp0l30tFH2zizKCZGazEriEV2vpPboWcfPNjKFjgzdQgfMNPeupt4f_ReRQFz9abik798s72tubV8afr5XQvanVyi5FK53cBOn5v53149e-Svua0PTTL-Rj4WzEK4zt07cunLD4S0C1oqBJ4Nq9jLwP0AF7qRudxHXTuusu32jt-b0cFvoiYO4IHNWBXktvQQ29yHRRIIj7cjKE1qJb814k4yxcsRUqWg2XwujMEHsy5dI8ICnZW6RP2wMknY8eJWu9onGIAIAInvF2G39vJzOO28z5nfj7M0lgvq7X2X-Cl7_sefFy_ak2gyshLd0qvWb3mlnRYYrBL51t8ks7G1j05UVGYI-qGI2ylNxGyjBwf1zDka2NinyyS-nKgaD1hBUMaeY-hJ5Lt-8jg7mmWOe3wc_QqdvOqqad_-8-LdunTwkb3wLVdo4m09WcbMwONSkUvBzQpSNAWf-zg8JFKDwh7QR-hMEQZsgESBo3hAeKasJe8XSbNiuvpJbdSCqn9go3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:04 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9Cu,pingTime:-10,time:1116,type:s,mvn:ZnNjPTEyLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNS4xMnYxMjAwfHwxNjAwfHwxfHwxfHwyNHx8MTIwMHx8MHx8MHx8MXx8bGFuZHNjYXBlLXByaW1hcnl8fDI0fHw0LzN8fDQvM3x8MHx8MTYwMA--,no:MTcuNS4xMnZNb3ppbGxhfHxOZXRzY2FwZXx8bnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fDB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS85NS4wLjQ2MzguNTQgU2FmYXJpLzUzNy4zNnx8MXx8MXx8R29vZ2xlIEluYy58fG4-,ch:n,fsc:17.5.12v220002022000220000022002220000022220200000222200022220002022022022222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022202220020222202000220000222202222202222000002002002222222202220022202200022002220222202,asp:1637250664501%7C%7C130e5e1a3f009f9fc9450119a503a5f5%7C%7C9ceebc4ad83ababb94d4029b4dca4e66%7C%7C0f8e68c6dcbe80591ac84dd36c7c6367%7C%7Cf654a20e0b670354866deb9cafae1cdc%7C%7Cac80d24056f0c99bb924d26d5c8dec13%7C%7C4222c926a71ce88e21437202f7e25b2b%7C%7C55c1941ca148e5e86e75bcefeedbbbd1%7C%7C1629390669,sca:%7Bspg:949e54f2-6a29-e93a-47c9-bbaf125c915f%7D%7D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:05 GMT
x-server-name: dt21.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 101ms
100ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9Dn,pingTime:1,time:1171,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1029~100%5D,as:%5B1029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:255,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:05 GMT
x-server-name: dt35.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 103ms
102ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9Dn,pingTime:1,time:1171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1029~100%5D,as:%5B1029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:255,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:05 GMT
x-server-name: dt36.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 104ms
103ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9Do,pingTime:1,time:1172,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1172,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1030~100%5D,as:%5B1030~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:255,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn,metricId:publ1,cmr:t%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:05 GMT
x-server-name: dt37.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 103ms
103ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9Do,pingTime:1,time:1172,type:c,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:1172,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1030~100%5D,as:%5B1030~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:255,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn,metricId:grpm1,cmr:t%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:05 GMT
x-server-name: dt28.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 95E9 42 B
174 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvYGCUeOMUxufebooQhV1djzJl5hL0P2dj2fmd82e03oP4mwcM89WiglGU74wxQXF5mgjo9KBVshHLXFlRWtR5foJV-pqUkOitcL3XmQVq222-T1Uka&sig=Cg0ArKJSzMAPA_QKygasEAE&id=lidar2&mcvt=1000&p=10,315,260,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20211110&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=1816371679&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&r=v&rst=1637250663814&rpt=454&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:05 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gn
secure-us.imrworldwide.com/cgi-bin/ 44 B
368 B 33ms
32ms Image
image/gif 99.80.67.55
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-us.imrworldwide.com/cgi-bin/gn?prd=dcr&ci=au-408075&ch=au-408075_b99_0&sessionId=ih8i01rvpi9ilkttxeflyi70hutup1637250662&asn=0&prv=1&c6=vc,b99&ca=NA&c13=asid,NA&c32=segA,NA&c33=segB,NA&c34=segC,NA&c15=apn,v60Bsdk&sup=0&segment2=&segment1=&forward=1&ad=0&cr=V&c9=devid,&enc=true&c1=nuid,jtjmurxqmhofydwjcrjihs9saqhbt1637250662&at=view&rt=text&c16=sdkv,bj.6.0.0&c27=cln,0&crs=&lat=&lon=&c29=plid,16372506625983842&c30=bldv,6.0.0.615&st=dcr&c7=osgrp,&c8=devgrp,&c10=plt,&c40=adbid,&c14=osver,NA&c26=dmap,1&dd=&hrd=&wkd=&c35=adrsid,&c36=cref1,&c37=cref2,&c11=agg,1&c12=apv,&c51=adl,0&c52=noad,0&devtypid=&pc=NA&si=https%3A%2F%2Fwww.onmsft.com%2F&c73=phtype,&c74=dvcnm,&uoo=&c62=sendTime,1637250664&rnd=60286
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.67.55 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-67-55.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:05 GMT
server: nginx
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-us.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
content-type: image/gif
content-length: 44
expires: Thu, 01 Dec 1994 16:00:00 GMT

POST
H2 204 collect Show response
g.clarity.ms/ 0
48 B 225ms
225ms XHR
text/plain 52.182.214.99
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://g.clarity.ms/collect
Requested by: Host: g.clarity.ms
URL: https://g.clarity.ms/s/0.6.28/clarity.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.182.214.99 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: https://www.onmsft.com
date: Thu, 18 Nov 2021 15:51:04 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:7f62cbe7-9d8b-4a41-a628-fbaa3aa5c695

GET
H2

200

sd
us-u.openx.net/w/1.0/
Redirect Chain

https://eu-u.openx.net/w/1.0/pd?plm=6&ph=dc423def-06ad-4fb4-a386-363c0a8315a3&gdpr=1
https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_sc
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPJSQ4p0-6Jdfhkn_v9aPYs&google_cver=1

43 B
114 B

21ms
21ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPJSQ4p0-6Jdfhkn_v9aPYs&google_cver=1
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.218.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:06 GMT
via: 1.1 google
server: OXGW/16.218.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:06 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEPJSQ4p0-6Jdfhkn_v9aPYs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 100ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9Tu,pingTime:2,time:2170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:2170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B2028~100%5D,as:%5B2028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:108,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:06 GMT
x-server-name: dt40.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 101ms
100ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukO9Tv,pingTime:2,time:2171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:2171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B2029~100%5D,as:%5B2029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:108,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:06 GMT
x-server-name: dt43.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOa9C,pingTime:3,time:3170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:3170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B3028~100%5D,as:%5B3028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:103,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:07 GMT
x-server-name: dt34.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 98ms
98ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOa9D,pingTime:3,time:3171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:3171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B3029~100%5D,as:%5B3029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:103,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:07 GMT
x-server-name: dt29.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
98ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOapK,pingTime:4,time:4170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:4170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B4028~100%5D,as:%5B4028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:103,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:08 GMT
x-server-name: dt35.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 100ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOapL,pingTime:4,time:4171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:4171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B4029~100%5D,as:%5B4029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:103,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:08 GMT
x-server-name: dt36.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

POST
H2 200 v2hikxFQzyc9o4HWg75LwlsvUcR5yj-O-a3RPMYTncpRnIed0dhepE_R6jh79yrjeAcd-rMoD3v1H6CmYsA Show response
chickensstation.com/ 197 B
280 B 25ms
24ms Fetch
application/json 35.186.219.42
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://chickensstation.com/v2hikxFQzyc9o4HWg75LwlsvUcR5yj-O-a3RPMYTncpRnIed0dhepE_R6jh79yrjeAcd-rMoD3v1H6CmYsA

Requested by

Host: chickensstation.com
URL: https://chickensstation.com/v2hqou17GCghnS4NOCIPBRrPgYaaQfmkICgh_Zauab57xLxEh8fkPe9Pb-eGb9dQT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.219.42 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

42.219.186.35.bc.googleusercontent.com

Software

Resource Hash

f42ef012105b858817daf979aea9f9030d54ff65a285cb9355d29a6265187f29

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; preload

Request headers

Referer: https://www.onmsft.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=15724800; preload
x-datacenter: gce-europe-west1
date: Thu, 18 Nov 2021 15:51:08 GMT
vary: Accept-Encoding, Origin
access-control-allow-methods: POST, OPTIONS
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.onmsft.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-hostname: c984a0b3
timing-allow-origin: *
access-control-allow-headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Cookie
content-length: 197
expires: Thu, 18 Nov 2021 15:51:07 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 98ms
98ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOaFS,pingTime:5,time:5170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:5170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5028~100%5D,as:%5B5028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:09 GMT
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 100ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOaFT,pingTime:5,time:5171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:5171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5029~100%5D,as:%5B5029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:09 GMT
x-server-name: dt25.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 100ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOaW0,pingTime:6,time:6170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:6170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B6028~100%5D,as:%5B6028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:10 GMT
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
98ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOaW1,pingTime:6,time:6171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:6171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B6029~100%5D,as:%5B6029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:10 GMT
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
98ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukObc8,pingTime:7,time:7170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:7170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B7028~100%5D,as:%5B7028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:103,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:11 GMT
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukObc9,pingTime:7,time:7171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:7171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B7029~100%5D,as:%5B7029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:103,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:11 GMT
x-server-name: dt10.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 98ms
98ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukObsg,pingTime:8,time:8170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:8170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B8028~100%5D,as:%5B8028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:12 GMT
x-server-name: dt44.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukObsh,pingTime:8,time:8171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:8171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B8029~100%5D,as:%5B8029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:12 GMT
x-server-name: dt45.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukObIo,pingTime:9,time:9170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:9170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B9029~100%5D,as:%5B9029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:101,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:13 GMT
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukObIp,pingTime:9,time:9171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:9171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B9029~100%5D,as:%5B9029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:101,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:13 GMT
x-server-name: dt06.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
98ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukObYw,pingTime:10,time:10170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:10170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B10028~100%5D,as:%5B10028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:14 GMT
x-server-name: dt33.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 100ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukObYx,pingTime:10,time:10171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:10171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B10029~100%5D,as:%5B10029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:14 GMT
x-server-name: dt34.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dc_oe=ChMIi6ftgaKi9AIVD_Z3Ch2bgQx0EAAYACDHyIhMQhMI-OzDgaKi9AIVE5h7Ch2hdQXh;met=1;&timestamp=1637250674419;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;
ade.googlesyndication.com/ddm/activity/ Frame 2E2F 42 B
254 B 57ms
42ms Image
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIi6ftgaKi9AIVD_Z3Ch2bgQx0EAAYACDHyIhMQhMI-OzDgaKi9AIVE5h7Ch2hdQXh;met=1;&timestamp=1637250674419;eid1=871060;ecn1=1;etm1=0;eid2=2;ecn2=1;etm2=10;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 744ms
743ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOceE,pingTime:11,time:11170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:11170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B11028~100%5D,as:%5B11028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:101,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:15 GMT
x-server-name: dt40.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 744ms
743ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOceF,pingTime:11,time:11171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:11171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B11029~100%5D,as:%5B11029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:101,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:15 GMT
x-server-name: dt43.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 98ms
98ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOcuM,pingTime:12,time:12170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:12170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B12028~100%5D,as:%5B12028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:747,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:16 GMT
x-server-name: dt47.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOcuM,pingTime:12,time:12170,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:12170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B12028~100%5D,as:%5B12028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:747,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:16 GMT
x-server-name: dt49.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 99ms
99ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOcKU,pingTime:13,time:13170,type:p,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:13170,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B13028~100%5D,as:%5B13028~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:17 GMT
x-server-name: dt18.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ 43 B
215 B 100ms
100ms Image
image/gif 50.16.140.108
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?anId=7529&asId=39e3e203-7da1-b793-f63f-537e17926895&tv=%7Bc:ukOcKV,pingTime:13,time:13171,type:pf,clog:%5B%7Bpiv:100,vs:i,r:,w:970,h:250,t:148%7D%5D,es:1,sc:1,ha:1,fif:1,gmnp:0,for:1,b11:0,cnod:1,gm:1,slTimes:%7Bi:13171,o:0,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:i,t:148,wc:0.0.1600.1200,ac:315.10.970.250,am:i,cc:315.10.970.250,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B13029~100%5D,as:%5B13029~970.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:true,e:,tt:jload,dtt:102,fm:sP8cVTe+11%7C12%7C13%7C14%7C15%7C16%7C17%7C18%7C19%7C1a%7C1b%7C1c%7C1d%7C1e.7529%7C1e1%7C1e2%7C1f*.7529%7C1f1%7C1g1%7C1h%7C1i%7C1j%7C1k%7C1l,idMap:1f*,rmeas:1,rend:1,renddet:DIV.qs.sn%7D&br=u
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.16.140.108 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-16-140-108.compute-1.amazonaws.com
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.onmsft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 18 Nov 2021 15:51:17 GMT
x-server-name: dt19.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cm.g.doubleclick.net
URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1

Verdicts & Comments Add Verdict or Comment

234 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

40 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.onmsft.com/	1970-01-20 08:09:06	Name: usprivacy Value: 1---
www.onmsft.com/	1970-01-19 22:47:45	Name: geoCC Value: DE
.onmsft.com/	1970-01-20 16:18:42	Name: _ga Value: GA1.2.1565518977.1637250662
.onmsft.com/	1970-01-19 22:48:57	Name: _gid Value: GA1.2.1686212034.1637250662
.onmsft.com/	1970-01-19 22:47:30	Name: _gat_ns Value: 1
www.clarity.ms/	1970-01-20 07:33:06	Name: CLID Value: f88dbd523f1b47dc9f6e1e5e3b4f45d2.20211118.20221118
.onmsft.com/	1970-01-19 22:47:30	Name: _gat_UA-71939551-1 Value: 1
.scorecardresearch.com/	1970-01-20 16:04:18	Name: UID Value: 1FJUCMGGZ6QLTFNEEK12FZg1637250662
www.onmsft.com/	1970-01-19 23:30:42	Name: fu Value: 1
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: 5pu0CoswlRg
.youtube.com/	1970-01-20 03:06:42	Name: VISITOR_INFO1_LIVE Value: sRmHkLrNuJE
www.onmsft.com/	1970-01-20 03:06:42	Name: h_zdbb Value:
.c.bing.com/	1970-01-20 08:09:06	Name: SRM_B Value: 0680AB0BAA09668E2626BBF8AB626797
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 08:09:06	Name: MUID Value: 0680AB0BAA09668E2626BBF8AB626797
.c.clarity.ms/	1970-01-19 22:47:31	Name: ANONCHK Value: 0
.onmsft.com/	1970-01-20 07:33:06	Name: _clck Value: m6yz7e\|1\|ewj\|0
.imrworldwide.com/	1970-01-20 08:09:06	Name: SSCVER Value: v1
.imrworldwide.com/	1970-01-20 08:09:06	Name: IMRID Value: 55116170-4887-11ec-b41c-ef42f1f56624
.onmsft.com/	1970-01-19 22:48:57	Name: _clsk Value: 1va86n6\|1637250662861\|1\|1\|g.clarity.ms/collect
.openx.net/	1970-01-20 07:33:06	Name: i Value: baffa6f9-bdf8-0d39-035b-d566ffcb129b\|1637250662
.rubiconproject.com/	1970-01-20 07:33:06	Name: khaos Value: KW54RSQA-14-H4ZL
.rubiconproject.com/	1969-12-31 23:59:59	Name: rsid Value: 1\|AIfsdBUO++vuGxiryvY4NyLgsLINffPD0nJRTZPyMmB0r4WWOQTuL9+dZLvlgeCkRh3C4GjGYWrGRQSWDHOtFAT+ngdWyQZYykB4JZyHexlK9j7tYKExPQ==
.rubiconproject.com/	1970-01-20 07:33:06	Name: audit Value: 1\|hLZGFuTafB10Ab94gXZBEUZeVCuLeoYaJAQRvrb7NaaVL7v9nbH7lvYuc4w7Y9XJdp/xrqZGn0RdggWqHah3qsxuhZpbWKLtnKXpBYfVaX8=
.doubleclick.net/	1970-01-20 08:09:06	Name: IDE Value: AHWqTUlrRJyooLCqFZ1izfc15cu8jMjdQcbRGorKGeK82HrymdfIiVErW4CvU_5LlxQ
.onmsft.com/	1970-01-20 08:09:06	Name: __gads Value: ID=855688b904e32862:T=1637250661:S=ALNI_MZu7iAw_GNz4kl_LhlHCA84IwJcag
.casalemedia.com/	1970-01-20 07:33:06	Name: CMID Value: YZZ2aH5RywDV9FYolBiE7wAA
.casalemedia.com/	1970-01-20 00:57:06	Name: CMPS Value: 5225
.casalemedia.com/	1970-01-20 00:57:06	Name: CMPRO Value: 1195
.casalemedia.com/	1970-01-19 22:48:57	Name: CMST Value: YZZ2aGGWdmgA
.adnxs.com/	1970-01-20 00:57:06	Name: uuid2 Value: 5875487948776139951
.casalemedia.com/	1970-01-20 07:33:06	Name: CMRUM3 Value: 2d619676682760CAESEPimU3D23FlZ1gWc2xITh10
.adnxs.com/	1970-01-20 00:57:06	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E?^p5w)t!]tbPl1M>e)ZlrFUfJ+tGXxo@::uMT8y/D1ISn[ZN$9DRXVZ9a^NC(X5lf4(bpRzqF1`b`YAIng^
.adform.net/	1970-01-19 23:30:42	Name: C Value: 1
.yahoo.com/	1970-01-20 07:33:28	Name: A3 Value: d=AQABBGh2lmECEAvLRMe8_3eYYyrhrP8LwU8&S=AQAAAq7lDe-PdGNoORnsAUUclPU
.adform.net/	1970-01-20 00:13:54	Name: uid Value: 7205066165083354651
.tribalfusion.com/	1970-01-20 00:57:06	Name: ANON_ID Value: a1nseFMwTkF6Xlypr9jZbh5y3nG5jcZcZcTpPZcsfVWps41AZbi2qBjyZaAVZbgBaOUDxx4LCFZavVXZcowPZbfSRbEEAt
.openx.net/	1970-01-19 23:09:06	Name: pd Value: v2\|1637250666\|gu
.onmsft.com/	1970-01-21 01:04:18	Name: _awl Value: 2.1637250668.0.4-5f47292a-213935311acede13ccdf3b129a29acae-6763652d6575726f70652d7765737431-61967667-0
.onmsft.com/	1970-01-21 01:04:18	Name: _admrla Value: 2.0-21393531-1ace-de13-ccdf-3b129a29acae

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YZZ2aH5RywDV9FYolBiE7wAABKsAAAAB&google_gid=CAESEF9cNuhmDo8fVfSKHE-kW-k&google_push=AYg5qPJbjoqaQBjPhsyBNyQbFGxMuHhV6ULL7brvjapmp8hEV9E_vXDPFjdEHa4QbVESO9yflt0PtAhhkQQomeZNrefta_xh-UzEZw&google_cver=1 Message: Failed to load resource: net::ERR_TOO_MANY_REDIRECTS

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

90fd985743128f2e586c40d1ae5c8949.safeframe.googlesyndication.com
a.tribalfusion.com
ade.googlesyndication.com
admiral.mgr.consensu.org
adservice.google.com
adservice.google.de
as-sec.casalemedia.com
bee.imrworldwide.com
c.amazon-adsystem.com
c.bing.com
c.clarity.ms
c.disquscdn.com
c1.adform.net
cdn-gl.imrworldwide.com
cdn.id5-sync.com
cdn.intergi.com
cdn.intergient.com
cdn.krxd.net
cdn.nsstatic.com
cdn.static.zdbb.net
cdnjs.cloudflare.com
chickensstation.com
cm.g.doubleclick.net
config.playwire.com
dapperfloor.com
dsum-sec.casalemedia.com
dt.adsafeprotected.com
eu-u.openx.net
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g.clarity.ms
g.pcmag.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gurgle.zdbb.net
hbopenbid.pubmatic.com
i.ytimg.com
ib.adnxs.com
ih8i01rvpi9ilkttxeflyi70hutup1637250662.nuid.imrworldwide.com
jogger.zdbb.net
match.adsrvr.org
mb.moatads.com
my.getadmiral.com
ns.zdbb.net
pagead2.googlesyndication.com
partner.googleadservices.com
pixel.adsafeprotected.com
pixel.wp.com
platform.twitter.com
pr-bh.ybp.yahoo.com
rtb.openx.net
s.tribalfusion.com
s0.2mdn.net
sb.scorecardresearch.com
secure-us.imrworldwide.com
securepubads.g.doubleclick.net
stags.bluekai.com
static.adsafeprotected.com
static.cloudflareinsights.com
static.doubleclick.net
static2.sharepointonline.com
stats.g.doubleclick.net
stats.wp.com
syndication.twitter.com
tags.bkrtx.com
teams.microsoft.com
tpc.googlesyndication.com
us-u.openx.net
www.clarity.ms
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.onmsft.com
www.youtube.com
yt3.ggpht.com
z.moatads.com
zdbb.net
ziffdavis-d.openx.net
cm.g.doubleclick.net
104.111.215.191
104.111.225.185
104.111.228.137
104.244.42.72
104.26.15.66
13.32.21.201
13.35.253.75
142.250.184.194
142.250.185.162
142.250.186.98
143.204.215.5
151.101.66.133
18.171.9.184
185.33.221.52
185.64.189.112
192.0.76.3
2.16.186.144
2.18.234.21
2.18.235.40
2600:9000:2057:5a00:1a:1459:5cc0:93a1
2600:9000:2057:d000:1d:667e:2a40:93a1
2600:9000:2057:e600:6:8656:f5c0:93a1
2600:9000:206f:4c00:12:4abd:d340:93a1
2600:9000:211e:1400:8:48e:53c0:93a1
2600:9000:211e:f800:14:2602:6e80:93a1
2600:9000:214f:5a00:2:42d9:3100:93a1
2602:803:c004:200::140
2606:2800:234:59:254c:406:2366:268c
2606:4700::6810:125e
2606:4700::6810:5f41
2606:4700::6812:c05
2620:1ec:27::cafe:1503
2620:1ec:42::132
2620:1ec:c11::200
2a00:1288:110:c305::8000
2a00:1450:4001:801::2006
2a00:1450:4001:803::2006
2a00:1450:4001:80f::2001
2a00:1450:4001:811::200a
2a00:1450:4001:813::2002
2a00:1450:4001:828::2001
2a00:1450:4001:828::2002
2a00:1450:4001:828::200e
2a00:1450:4001:829::2004
2a00:1450:4001:829::2008
2a00:1450:4001:829::2016
2a00:1450:4001:82a::2001
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::2003
2a00:1450:4001:831::2002
2a00:1450:4001:831::2003
2a00:1450:400c:c07::9a
34.228.209.86
34.228.50.94
34.254.9.67
34.95.92.134
35.186.219.42
35.186.253.211
35.190.76.239
35.201.98.64
35.244.159.8
35.71.131.137
37.157.2.239
46.105.202.126
50.16.140.108
52.142.114.2
52.182.214.99
52.215.85.116
99.80.67.55
009bf00d3831fb62595adb20e170ed288d8a157493fb6028b1888b05875ed8f3
00a57617df99ac957720b7332f9d15449def3ebe11169d68f12c47a3cde5168d
013d915dd062c2970864ce58149715bbd5b4e6ac2dfc21531badb6d6f957a619
0210bcf8c6f9fb41e1db722e8ec3c318101342f5922c59331321c993df1720d1
0271a4b8219480a5ffd0b7d1bbbcbe3775b14b5e46b35d054cbe307ee49e24df
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
077740dd091fcb598214095438d3e3d87578fe30cb74ea2b4454e47d1a6acdd3
077cbc5475d39fca27354bf7d16c9de766acba969edae830c856e152f07f846a
08b936e11e496c1c84af9020c96c66829f9aef934a0754f44b24706505034b23
095e103c11f57bcce352c3b76fbae89af807362808b618a760c160dfef10d076
09c7e495b4c16e98a6bd5a5a45e908cfb8edcccd2409e96cc99199972eb032b3
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ebbc7fba9a50d36ef5422345f624431710db4528f25749d1d438c2c10bb69f2
0ff5b741ce41680cf5ac37e619e1c35cbe4f1dd7f812dcd68924a126a6959b33
10874bfbd8b6d4a52eadf63e448622161b6d7f174084758557c12cfd22f38d36
113c57ce2fcff5c63de9cd958661c4bb59385cb644f07998cf2b9a428cf1a649
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
130a9738dafedc6ce6c52b9def9a06df21b97b6b1f46175f1ef8315bd3975ef6
1331ce07d67579b7a85c3f1deb9479460b198356c6d1aee8de72daa1d5e377b2
14b307ca014eb6ef91b493be723343b71a1b8e876d20522e794cbe74c8f7cd6a
18344242ff477e6698f24b0211d53b9194cef9905ad67c8649e8a41ce614b415
1b6e0cc5ce7dad5ae275d7ac33c17034f27f801270805bf8d320bab919045a2c
1b8ea3665c171dfb165266c135c84516e4add691e3ecbf4f03b3272557cb70e2
1e56e1d859582ac27c8ed511adf786fcdb2ea46673e6fccacc25a1505c6d8dc2
225a5d44793400c62040e70a55fc77beed0a3cbc0d7ac361abbf4085392b1e20
22af5d3bf749542c2d95975186991b7b8c1e0766449c3fdeab55d57eb0d1ffdc
233bc983d773cb9a38ca251753bd43f9a2288279fab44598b49c433b32f6d285
2538a0fba24a9c5fdc455e3978601c55be5601afd25dc1025446ec5a075fc61f
28b11959f68db701b4218a36e9a8e8daf47fbfe4057f086595ebc2b0df44fbea
291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc
2977bb94c82e5fdc0c4922e57b17113c391a439a9a7065d4a87f938e82fc3be1
29be43ca0b70c4e225ada478f84eb07291171636c30c57b249fb7d26b7a09ae2
29efe7847837e74a124c0e584030e9afa5463de12128d5d5477d548b4fa6d9a5
2b7dd6ea1f8ef8753125dbbdb857e5e37920268c002c9c22b61e52194a524a12
2c29a7fe1caaf6c6bf467478279396da9dd1cdc2fb7ab0d4d48fbfff91778cdc
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
30c035a23faa9b9a0f86478fad65f95c99849554bb16d57d6b56b2609cfe92e1
3131e5cc32f0402b4fc1137b12dc65c053fc3ae2de80955050f1f6eca08fff47
32d527616568560a722b8ff8ebd45a45769282cf230d51be032d3be707527795
33a3b2b4bb13ccc6ea24e09ac28cf3934212a8191289ff8e032b8a25d84997f8
34c9d80301ddd8577c194e8e894d525771c5ea330773bc6731c8942e3266fa2b
353dd5e5024f0848ad4c84c1675cdef2619a67e9db1a562046982a6463ba8a81
36eb26e781bd5df368210633ce1197df38df32820e93c18e48afb04ad1cea627
37177d430f1a4457fe75814774e4eb49b5107f5eacaf93a8c7d6f64d9a04e252
37a8f221060570aa879aaa77d61bc2321fcdc97a7de9558a716fb40cfed41689
3982be2c95b6e0cc6918d2a1c8d993a812a0873a393acb8b5a65c0dafa68e0a8
39ab56ea8360e18c7757efca692a5703474a0e30102ef3e986f7f935bd5d66fc
3a9430686f271be35c5027e71e6c54b6830099c37346affc7a2219dad9824dd8
3aeb3bd5507f3536a83e52d8a8387d41dc5bc3636a99ada2405220fa6d7cc032
3d54932c098ba6088e2c2ca78b976bb2668542c4bc8902c3cd0ea150ba9d6278
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
411626d5e8eb3616fad95e39e91afe59dcfd424b9492c2c43c76a5199dc69768
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4580416002c331987b7fd1851f5ea1833e19b334f36246f5770b3f453247fc58
47fe7139b30920fc0e3333b06e00a500ad68baa4cb214e9717ce2aee1c621a17
485a81bab58dffc36cba3d721a7d1fc7dad48bd8b24563e399b8d01cbdbed611
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b7e671011de15bd25ed5d647d924227c6d77d4f6796c1e43ba42fd3f2d7db54
4c0eb329993657c2feb1afd587efd8fd987fea96465907c2be866be558ed03bc
4cac22856ca12ba1ff5560960edecd6012330c3d3ad11b4000133a84b320b4ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e523a5ae5b4636c75901b79fafbd3912e41dc7987414e688b09d4b436ff22b3
4f30bdeed794aeb92d85e55d901c0bdb634df32432010792e3b569ea73cae443
4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
52441c4972364be6eea1460da73f37a3eb442169c2766696d4e82044a22f3564
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
544655deb2ee0c64031ce29769c557f467a81dc635a70f19f348869a224fd8a3
58d221914c062c193f1658291cca5d00d1763feabb3ccc789891281068514019
5a469a5ea6249c58faebabd539180650ed214c8f55d2f3e909b88e16e18bd1ac
5a57cecd2bf4d6d3b8498c67487333f6dc9e102371f5e48ffc7fcf18a6e8487e
5bbe3fc1b22e847e9b39b5e3d2e0a3a1d7bc3f0881af180e2a702aa3a4a10266
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5bf0a170ae91f1bb8d0c94381a74ab8b85f938bf31bf18a9c8e3b835250d3be6
5c5c45a24816f8401f7c6b6636addab51fe390c9edc40116c8ddd8dd8e80fffd
5cedd5abd94d64b07e3779451d057665572b89caa8b445a5e9efa42bad9c4274
5db2038f2fc6fd83f631e2991466fc9ae11d7183809a2dfa7d990fde6e19b1e6
5ecb58845a9ac30e4eb4b18eb0e7431ba1fb195ce035309735efaee67421c7a3
608df1d6ecc4720a3cddee4abdb6e9da22c0a52c6fdb2b3f37ac21d8507f0122
61b2b568c1b892a6ad33889445bd22708ec2ba507ce7f288a18a08b3197dd1eb
623ef51142e247565d210522bf42c0e5057cd44b3c2097a12d77fad98384cf50
6468f493433bd9493a471659f516879591aeab56d7af974055300d6aca96845c
65d4b2a87b2d915a138d7e023b49f05d61370f90d07cae5a030017b0de2f827f
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b12326de41dc70e116c8d2e6b1a4f5dc046a00408aefa7b9324ac48947f51ac
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6e8da7b6eb5213262640cb4544153080dbdf31dda26948a97c135b298eb8829d
724d5e151b4ba82f7eaf29667bed3a5ae2167a00343cfbcf2ebed5df806d914e
726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3
728ab0c54302372078c717aeffa400a77723c58d9345cebce77d303cb400ed68
73820cec41788325fa809ccd7f96f002fc052cb004bb2045feb3a8e023d5cfa4
73bb49742c8bbcd16dc2da58fae00c67a0cb96576b8bda53619ef215b0a2df78
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
75481bc06d1b02e50fd1cc921a7838e3af6caa9b8c0745b50182ebf29f195e20
76bd483ba071899420c9c8428a6b5975605f69e50de11df4c009286324bb5dda
775a02c37772954d38fe41b802b94a0ee37dccb98a03827cdef3eddd2abc13d1
778b9c92e72de3d33310a1ebdddf04ca1e335f0e64829f5ac55b1719d5e135d8
77af01d79cf3cd7c3abd4efc08dd7d75d8c2d07ce3861a27eb9016eefe68cac3
79d0a50751ad1a9537b018a92f32131b6d993728547b5f2725efdae517f5d52b
7e41ca21e421f129d3881e345f990027b66c0ab3c5580e549575f9393d117cbd
7fb740dab4620f2d5de41d2d9f0bcb6028e02cb761490bce0c88a14c1a907727
81203f5c4851e1731ba31db18c9a0a62668d43eabc4192da5c318034d2cdc1de
81cbac68a8a375ddbacaef7e44bebbf57ff3709337c631f41ce6a49996c1c861
82d060cc3dc6937c8718d53041dd21b0caf9fc0ae4421aa1f17afe26eb6f2b51
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
857a370261cc81c30486931ed1f8a6aaa33f439114de8e2ba59f6046e0e9febb
8665185ccda60f01b7e1b7b78b569ee987653a9261628fdea303bf1042cbc8c4
86fbfabe474a7a211f25f226cb28431b81d2cdea2900203c1532fcf572423c3f
87c056265c6a6e8c1d6ea9385ad66dbfd5006dd6d3c73b656db2b34f2cd7b8a2
8802ba4a157c0e4b8fdd090f86e17761688391681c9dcc41f3af077b44b2931d
88915cdc03fc5b9a20aec966fe93ee38aa3fd76bfef296e41d305271b3541c96
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
8aa335ad864ac08058c857f05f31cc4c1853a014859bd8ebff6d2a54e05813e8
8ceb3992861ed1fda25855c2e500e76842ae0d788405e50e3a9f45df36499cf6
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8e662cd2ca55a4bddd132966304a69f7643154d359c97ab4850606922be42556
8f1b51337be99b356f1400fd895035f8022d4fa8a99b17c16a3500445fab1b73
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
924dbe12660fa25d89977aaddceae50c097be41b7c0d75ec5033ec77ffd956e9
949192cf915ba5e7aa5ee91f12efccc64db5f7f5c99ca44e9e6a7634c1a64428
97ce1e1f5dbfda35ac979b593e79e1673a3e725790339d767e4a6ca6e94a4828
9841dd925aeeeeb4001bd50277203f34f2681f2fd8afb321e845aba54cfb0146
98d4dd783896cd839a5c25cebfd53ce0f74febd28be7d1679d5d4f5b115751ba
99676824143e650821663a625e811e4b1f74ad095dd94e2ef134fc5dc3286aa9
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99ecb14ec0a4e706ee386f1bde1a4684119fa8e100f24821f71f7fa75ccd481d
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9db8a678d1681c1c4a3f15e1769c3f54d96f126db4a7b00cea65127c820a7763
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
a07ab1bfcc027604b196e3123c4d4c143cbd842d907ce7783404ed476f6d4d46
a1790a7910ec2ecb48fd04ea34066eb3848b0b25fd58ba901583ef0ce447dfa8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a4f9c1995de9f92f05f1a5cd0c4987e359e1aa41613bb6a33f9c82837b29e6d8
a5dd1df6b0ecab77f115a119e53f0100f0440faf7d83cd687da29b659555e497
a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a87d4c2682d10f0750f0e1142e25fce055f0ae596c7a277bbaf2427ddae146bc
a934621dc97e4ded859fe0b4855b8a5359575f95b723812c92d776b4d98abc77
aa19b4b863038abcb52c6fb867b4d1189a7d1be3d174df57751865890ec06acb
aac21a310e8bbfe3a731c58bc2995d78b8cdc649e401893c9c18f0bc0ea4980a
ace4208545fb0ff5ea87fbe1470d3bf0af8e73d7d52fea869966c4b9d8c78a60
acfef4e803a39000c9535a75ca01f24a305983b95e11fc836cdbf17057bfdaeb
af8bf24084056feb9721b81b30360895b9c907a88a391f2eec8701eeeb3db506
afff706f1439f94de9b30ff01e6fc0a02c856c2d28a20cebf14b6f8adef33593
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3608c1e25f786e7fa295bde2152b045f2d08ae42ae1499b5a3f1e9839c0381d
b41e0020ff5a4bec857828c37b9a425a5e0024aac1fb1519dd9cf4562f0681ee
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b864352149b314faf27427a04f4ac274938496f8c4513aaed4f12df475bfedca
b88fca268e1352a0922f301c6b88f0499606c01faa8d0718de11a8153a5edc3a
b8bd60cfe92807d6cff14f0283a8341fe276c34d97384f8255de10176764cc04
b8d36873e116f6537f2ba71fc43dea922cdc1f70a77aa2674283c1c51509ff1e
b95136fff5ac2d034bff45ea612eb8b014703a6537d2571a9858c51cad245ba9
ba2ad3ab1a3bc76b2d09ae1becfd7e6bd9d868eecc6af4d2fed12915d1d77315
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bbb8006559ba0fec76525d893b34927bb2504d9eb8560f5f2632b26d6d7ef544
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
be5913c6e9820dae39a9bdadbd7bfd525f076299fe92ac078cc668abc56d9550
be9c20cc4a0dacfbb9f19ba5c679327b063678f1568ccf7350838baf3cffe49a
bf0536a7ccecbfef8793cfc6a61b4454864a4197992ce5ddaa014b48f72bef9b
bf99659b83fd9ba30e7bd362202408f37498b89a0cdf0457b9913fe60ec463f0
c196bd11a6ada8107e9f065486e36c8db58b03b529bf891970b9336efd8a6130
c1ca15aa8598ac972f25c8812a1c189cd22f8926ec7b890bc8ea6a70a7779fd1
c500b9ec8aa695f3bbd0de51b74233cf374f25ad1cc79d871eea35543b6d7752
c5188a63ae5821b2252177fdc0e92545890211f43afe037f635ba2cb9d72c094
c6107c1c1f1588cac73cb68d83222515b12c5dbf7f988fd0c39b4ff16414d3bc
c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e
c73dd814f0b64077d7585fb3e536ee7474d68af2421052b86da25969def2e48d
c824c03e1cef40b4875f33a8584f82475c493ca230ad27d84463ffcc755b005e
c9ca9fbe90c932d2954e1c8cb18dea47e37035aea6157e8e10a97e70f09402fe
cbebf07816872ad458048f157448b98cb746be84e27e254115cd3603b4ee5829
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d3efb7681c7115f4e3fe68d1a2869505712accffe083ea5e8a444a3aba74609d
d49d4380f8613d1bf4336bc6bc5706205737451218d8aa999d3d01beba95096f
d725b40a340267e4a4d620d012e4310535cf29ce0379b4848e20111e8574a20d
d7bb934e518c87d758dd90505d1ed7c16de4f044fcd666156cde2050c10802c3
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
d8685d9f00e3e1bbd661e6e8f170759462bec4dade694ebf6dab636316fb970b
d8f65aee51ad720e50384aca26eaa85563f1d6f656ae418c687594e7536d0dea
da05e8d8fd53ff2e65e53a572be3999483ca18f9a72c4bbd66ab1098c4946210
db02d0faf424a7ebc376ec36b7063b8b397d606dcb44fd0f14c976fcbd991c49
db8827df299fb574b5b1019eca3d316bec9ebefcfd279f9bd0eb591bd991abf2
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de39bdc1a44f5b3c9cf0e8991933d40717ac10e047eab53b89e355e1bc75b017
de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980
df88df96f09d9747755aa2b1f44bc857078fe9a8b6807897ed99d366d7271b20
dfd52d8f064d5991a1206b67804f71a9d3160e5f2a1413eed36280670e5e2795
e0110424e9bab1a8121139a915743736e98ec8f432f221db9e3b704a14a374b7
e1124180d382cf3f1dbab161bd5c6f1966f75d4283332e4db2f7c20bd5194726
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e6b4122b94b82886e32952c07c78d342647b3a38a2834f4489e0922308a95eab
e7907336273196ef7b66c3c9377e5958d4c7e9691de3e67dca3a803138344a00
eab9caf2a800fcb29b7b57b6fa4c87f9c98d1b53bfd1f079e8d4db48f1728241
eb6883bc39782219d9eb3868c4e21acbdf949cc1a13bd35fb86bcb447488a977
ecf917978118862ae1fc715ef2f5d7cf541d22cf515bc480c07324037b8bba01
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
ee33f1f4475d95bc43bc979a1a6dd531b3e52e226326c75471fe259f00088c9c
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f05d95a46d0f6c095d27ff0f82251f12a6bca239b9bfaf7b956ef64c4cfbd826
f0b657941d77683754e93d7c317fbaf8f3ac530caa74b312548ca7b9384d8795
f25ceacfdda3e11632b251b866093d8f0d934e6ba51a539015e5e9a6652cc48d
f2640f97f4f4fabc63971ceed2b746be5dfb197bba340759a70636ce13cb59e7
f34eb36d55671917a126b11b2d7a6f67c84a56567e2a42ef35a4ce18c7936da0
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f3d00155801e6b15fb665f88e1a32a7e171bcdd8a69c80eaf3214ebf12765bd5
f42ef012105b858817daf979aea9f9030d54ff65a285cb9355d29a6265187f29
f4d0c6a094ec876c2dbea780dac5655e44bc1ec2b0c9c492f8513581879c89c5
f9384d1dd440619b40a97f2b756f3e1b9336efce2c87977001f49d81d1556b81
f93d6aac2996165254aceb217fd491b77cb5da8667b7bc90ba9f47242c98b91a
f9c6e32ff834ad3b6069f9bc17ec6c678eeaca93a167d7d76acc1c1530d514b8
f9e4b6aece572af3dfffd45e4537d2cc2b4bd25125acfcbbe1b8c9b4c6394afa
fa6953b24e42640645ebc36a7bdead13b10abdddd28abec1d8d7904d329e6cd0
fd585b8497157f0c86361f32a9d16fc639415ee64361d7c36f9dc4b981bedf9b
fe4f1f5764ef817a6b57ed82ed0f1f166f81936f7f0b6c645a64d6e05bad86d2

www.onmsft.com Open in urlscan Pro 104.26.15.66 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

312 Requests

95 %HTTPS

48 %IPv6

52 Domains

81 Subdomains

66 IPs

8 Countries

4275 kBTransfer

13627 kBSize

40 Cookies

12 Outgoing links

Page URL History

Redirected requests

312 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 14 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.onmsft.com Open in urlscan Pro
104.26.15.66 Public Scan

Screenshot
Live screenshot

Full Image

312
Requests

95 %
HTTPS

48 %
IPv6

52
Domains

81
Subdomains

66
IPs

8
Countries

4275 kB
Transfer

13627 kB
Size

40
Cookies

312 HTTP transactions
14 data transactions