wheregoes.com Open in urlscan Pro
138.197.62.132 Public Scan

Software

sffe /

Resource Hash

21543c740d93eb090620e7a78b258b8cb3679c94957296f52e65bd19be2bfc85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 06:39:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3367
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127664
x-xss-protection: 0
last-modified: Thu, 09 Jun 2022 08:36:59 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sat, 17 Jun 2023 06:39:27 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 94 B
719 B 74ms
28ms XHR
application/json 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=wheregoes.com

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3eb7350a0588ff4e1af60592b47c3a3c535379bf789126fcdf9737d2e80057e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Jun 2022 07:35:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 83
x-xss-protection: 0
expires: Fri, 17 Jun 2022 07:35:34 GMT

GET
DATA 200
OK truncated
/ 15 KB
15 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c72f57881ea9665da29cc614802f61a04084e06b14de9f1d79ce26273e66a991

Request headers

Referer
Origin: https://wheregoes.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

POST
H3 200 x Show response
api.fouanalytics.com/api/ 0
525 B 234ms
211ms XHR
text/plain 2606:4700:3033::6815:3a2a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.fouanalytics.com/api/x?FPDaU1hQcYkQMeoT$dXJsJDAkaHR0cHM6Ly93aGVyZWdvZXMuY29tL2h0dHAtc3RhdHVzLWNvZGVzLzMwMi8iLCJyZWZlcnJlciQwJCIsImFuY2VzdG9yT3JpZ2lucyQwJCIsInZpZGVvJDAkMTYwMHgxMjAweDI0IiwiZnJhbWUkMCQwIiwiaGlkZGVuJDAkMCIsInZpc2liaWxpdHlTdGF0ZSQwJHZpc2libGUiLCJoYXNGb2N1cyQwJDEiLCJ3aW5kb3ckMCQxNjAweDEyMDAiLCJwaXhlbHJhdGlvJDAkMSIsImlubmVyJDAkMTYwMHgxMjAwIiwib3V0ZXIkMCQxNjAweDEyMDAiLCJsb2NhbFN0b3JhZ2UkMSQxIiwic2Vzc2lvblN0b3JhZ2UkMSQxIiwiYXBwQ29kZU5hbWUkMSRNb3ppbGxhIiwiYXBwTmFtZSQxJE5ldHNjYXBlIiwiYXBwVmVyc2lvbiQxJDUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTAyLjAuNTAwNS4xMTUgU2FmYXJpLzUzNy4zNiIsImNvb2tpZUVuYWJsZWQkMSR0cnVlIiwiZGV2aWNlTWVtb3J5JDEkOCIsImRvTm90VHJhY2skMSQiLCJoYXJkd2FyZUNvbmN1cnJlbmN5JDEkNCIsImxhbmd1YWdlJDEkZW4tVVMiLCJwbGF0Zm9ybSQxJFdpbjMyIiwicHJvZHVjdCQxJEdlY2tvIiwicHJvZHVjdFN1YiQxJDIwMDMwMTA3IiwidXNlckFnZW50JDEkTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwMi4wLjUwMDUuMTE1IFNhZmFyaS81MzcuMzYiLCJ2ZW5kb3IkMSRHb29nbGUgSW5jLiIsInZlbmRvclN1YiQxJCIsIm5hdmlnYXRvci1oYXNoJDQkMjRhMTEwNTIiLCJuYXZpZ2F0b3ItdGltZSQ1JDMuNSIsInNlbmRCZWFjb24kNSQxIiwiZm9udHJlbmRlciQ2JDEiLCJ0aW1lJDYkMTY1NTQ1MTMzNDI4MSIsInRpbWV6b25lJDYkMCIsInBsdWdpbnMtdGltZSQ3JDAiLCJwbHVnaW5zJDckYjZkMDU1NTgiLCJtZW0tdG90YWxKU0hlYXBTaXplJDckMTAiLCJtZW0tdXNlZEpTSGVhcFNpemUkNyQxMCIsIm1lbS1qc0hlYXBTaXplTGltaXQkNyQzNzYwIiwidGltZS1kb21haW5Mb29rdXBTdGFydCQ3JDEiLCJ0aW1lLWRvbWFpbkxvb2t1cEVuZCQ3JDciLCJ0aW1lLWNvbm5lY3RTdGFydCQ3JDciLCJ0aW1lLWNvbm5lY3RFbmQkNyQyMTIiLCJ0aW1lLXNlY3VyZUNvbm5lY3Rpb25TdGFydCQ3JDEwNiIsInRpbWUtcmVxdWVzdFN0YXJ0JDckMjEzIiwidGltZS1yZXNwb25zZVN0YXJ0JDckMzY5IiwidGltZS1yZXNwb25zZUVuZCQ3JDM3MCIsInRpbWUtZG9tTG9hZGluZyQ3JDM3MiIsInRpbWUtZG9tSW50ZXJhY3RpdmUkNyQ4NDEiLCJ0aW1lLWRvbUNvbnRlbnRMb2FkZWRFdmVudFN0YXJ0JDckOTQzIiwidGltZS1kb21Db250ZW50TG9hZGVkRXZlbnRFbmQkNyQ5NDQiLCJuYXZpZ2F0aW9uLXJlZGlyZWN0Q291bnQkNyQwIiwibmF2aWdhdGlvbi10eXBlJDckbmF2aWdhdGUiLCJnbG9iYWxzLXRpbWUkMjIkMC4zIiwiZ2xvYmFscyQyMiRhZmIxOTAzZCIsImRvY3VtZW50LXRpbWUkMzIkMi42IiwiZG9jdW1lbnQkMzMkMWE5Nzk1OGUiLCJjb25uZWN0aW9uJDMzJCIsImRvd25saW5rTWF4JDMzJCIsImdldFVzZXJNZWRpYSQzMyQyIiwicGFnZS1mcmFtZS1jb3VudCQzMyQwIiwicGFnZS1oYXNoLXRpbWUkMzUkMS44IiwicGFnZS1oYXNoJDM1JDAyODYxMjE4IiwiZm9udCQ0NiQxMDAwMDAwIiwic3R5bGUtaGFzaCQ0NyRlMGEyN2IwOSIsInN0eWxlLXRpbWUkNDckMC42IiwiYXVkaW8tY29kZWMkNDckMjIyMTIiLCJ2aWRlby1jb2RlYyQ0NyQyMjIwMDAiLCJjbG9jayQ1MyQ0NTM5Iiwic29ydCQ2NCQxMC43Iiwic3RhY2skNjYkMTM5ODEiLCJzdGFjay1lcnJvciQ2NiRSYW5nZUVycm9yOiBNYXhpbXVtIGNhbGwgc3RhY2sgc2l6ZSBleGNlZWRlZCIsInN0YWNrLXRpbWUkNjYkMS41Iiwid2ViZ2wkODQkMSIsIndlYmdsMiQ4NCQxIiwid2ViZ2wtdmVuZG9yJDg0JEludGVsIEluYy4iLCJ3ZWJnbC1yZW5kZXJlciQ4NCRJbnRlbCBJcmlzIE9wZW5HTCBFbmdpbmUiLCJ3ZWJnbC1leHRlbnNpb25zJDg0JGM1MzgyMGZlIiwid2ViZ2wtdGltZSQ4NCQxOC42IiwicGVybWlzc2lvbi1nZW9sb2NhdGlvbiQ4OSRwcm9tcHQiLCJiYXR0ZXJ5JDg5JDEgMSAwIEluZmluaXR5IiwiYXVkaW9jb250ZXh0JDkwJGY3ZTcxMmQ5IiwiYXVkaW9jb250ZXh0LXRpbWUkOTAkNDEuMSIsImludGVyc2VjdGlvbi1zaXplJDkyJDE2MDB4MTIwMCIsImludGVyc2VjdGlvbi1lbnRlciQ5MiQweDAgMTYwMHgxMjAwIiwiaW50ZXJzZWN0aW9uJDkyJDY2IiwicGVybWlzc2lvbi1ub3RpZmljYXRpb25zJDkzJHByb21wdCIsInBlcm1pc3Npb24tY2FtZXJhJDkzJHByb21wdCIsInBlcm1pc3Npb24tbWljcm9waG9uZSQ5MyRwcm9tcHQiLCJwZXJtaXNzaW9uLXBlcnNpc3RlbnQtc3RvcmFnZSQ5MyRwcm9tcHQiLCJhZGJsb2NrJDE0NyQwIiwiZnJhbWVyYXRlJDE1NyQ3MA~~
Requested by: Host: api.fouanalytics.com
URL: https://api.fouanalytics.com/s/pp.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3033::6815:3a2a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:34 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: *
access-control-allow-origin: *
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NRScjkWMNeXjvKaRKvaoK52cLGOL%2BgyLypP92N1O2qSFjA09viifevDoziZMWsr12wfwObSYl4%2B1txAoHVGH%2BPM2hSh7MYhbkscl%2FOw8lgM5YoP0Y8EJ1TEwm9mLpTLlQmPowEzB%2Fx0JCDmc%2BQkr9q3RZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 71ca1bf938f89975-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 CEAIT5QE.json Show response
srv.buysellads.com/ads/ 934 B
672 B 322ms
103ms Fetch
application/json 143.198.21.127
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://srv.buysellads.com/ads/CEAIT5QE.json?forcebanner=455296&ignoretargeting=yes
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.198.21.127 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: srv-us-ny-24.buysellads.com
Software: //srv.buysellads.com /
Resource Hash: 41adfa9ccc16d506049595a5e7296446e11a31253bf7911c964bdabe1e32c7bd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 17 Jun 2022 07:35:34 GMT
content-encoding: gzip
server: //srv.buysellads.com
content-length: 559
vary: Accept-Encoding
content-type: application/json; charset=utf-8

POST
H2 200 adreq Show response
ads.servenobid.com/ 645 B
673 B 408ms
323ms XHR
application/json 18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.servenobid.com/adreq?cb=7516
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f7501249fc1999161b3b16b863157fc7246360d4c2cfcfbe423dba07d8bba3dc

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 17 Jun 2022 07:35:35 GMT
content-encoding: gzip
amp-access-control-allow-source-origin: *
vary: accept-encoding
content-type: application/json
access-control-allow-origin: https://wheregoes.com
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true

POST
H2 200 v1 Show response
hb-api.omnitagjs.com/hb-api/prebid/ 356 B
705 B 497ms
428ms XHR
application/json 185.255.84.151
IGUANE-

General

Check archive.org

Show headers Download Go to

Full URL

https://hb-api.omnitagjs.com/hb-api/prebid/v1?RefererUrl=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F&CanonicalUrl=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F&PublisherDomain=https%3A%2F%2Fwheregoes.com

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

185.255.84.151 , France, ASN200271 (IGUANE-, FR),

Reverse DNS

Software

ayl-lb-fra02 /

Resource Hash

99462c655fb7b9cee72f72f70dbc63a96319f68c8cfa975ce1a3c4dd01d089c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:34 GMT
x-content-type-options: nosniff
server: ayl-lb-fra02
vary: Accept-Encoding
access-control-allow-methods: OPTIONS, POST
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-max-age: 3600
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-envoy-upstream-service-time: 398
access-control-allow-headers: Accept-Encoding, Content-Type
content-length: 356
expires: 0

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 93 B
743 B 164ms
97ms XHR
application/json 216.52.2.19
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_4.43.0
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: ca6697d70aa5804ccca919dd2e1f4a8f8599748766a53c4b936331d8db6eaa6b

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

Date: Fri, 17 Jun 2022 07:35:34 GMT
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://wheregoes.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 98

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 260 B
1 KB 142ms
84ms XHR
application/json 2602:803:c004:200::143
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=18812&site_id=405332&zone_id=2271886&size_id=15&alt_size_ids=2%2C16&rp_schain=1.0,1!buysellads.com,15074,1,,,&rf=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F&tk_flint=pbjs_lite_v4.43.0&x_source.tid=b0305901-a3ad-4f5f-9f39-ad8d564492bd&p_screen_res=1600x1200&rp_secure=1&rp_maxbids=1&slots=1&rand=0.7548288607890987
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2602:803:c004:200::143 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: df38ab9048f6a413d6a12336f8fd1018e68257403a114e320283e62f688048b3

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:34 GMT
Server: nginx/1.21.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 260
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 139 B
830 B 88ms
38ms XHR
application/json 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

2d865d54bee641400d4f620d649e1f5181636637be2bb3de3473b3138f1e4340

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:34 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 539ff096-defa-4a03-b765-52e2f1c41d21
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://wheregoes.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 139
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
290 B 164ms
115ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969d17017c7c2764ee2809e73b0016&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: c9a44f072b75472727ae436bdce397c580deed1d90c49f657991c875be1c5d15

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 17 Jun 2022 07:35:34 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

GET
H2 200 bidRequest Show response
c2shb.ssp.yahoo.com/ 62 B
92 B 196ms
148ms XHR
application/json 35.157.246.167
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.ssp.yahoo.com/bidRequest?dcn=8a969544017c7c276e6e27f4ecfe0019&pos=8a969544017c7c276e6e280b8d4d001c&cmd=bid&secure=1
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.157.246.167 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-246-167.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.46 /
Resource Hash: 68a23b8026472accf1099db5f6c39c44501422c56d31c4bdd00115865f340eda

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 17 Jun 2022 07:35:34 GMT
server: ATS/9.1.0.46
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
content-length: 62

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
360 B 68ms
20ms XHR
application/json 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

bidder.am5.vip.prod.criteo.com

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://wheregoes.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

GET
H2 400 display Show response
mantodea.mantisadnetwork.com/prebid/ 56 B
331 B 354ms
115ms XHR
text/html 52.206.247.208
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/display?tz=0&buster=1655451334716&secure=true&version=9&title=302%20Found%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F&measurable=true&bids[0][bidId]=191931d89190fb2&bids[0][config][property]=WhereGoes&bids[0][config][zone]=Wheregoes_S2S_Leaderboard_InContent_BTF_ROS&bids[0][sizes][0][width]=728&bids[0][sizes][0][height]=90&bids[0][sizes][1][width]=300&bids[0][sizes][1][height]=250&bids[0][sizes][2][width]=336&bids[0][sizes][2][height]=280&property=WhereGoes&foo
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.247.208 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-247-208.compute-1.amazonaws.com
Software: / Express
Resource Hash: 5352720a5ffb778e42dbb1d4b81c975c02018dd660e1fe9c430cbf13dba78762

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:35 GMT
x-powered-by: Express
etag: W/"38-oN4RNSEETikJBvZER0pAAAEOHrw"
vary: Origin
content-type: text/html; charset=utf-8
access-control-allow-origin: https://wheregoes.com
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-length: 56
expires: -1

POST
H2 200 cdb Show response
bidder.criteo.com/ 18 B
311 B 391ms
52ms XHR
application/json 178.250.2.131
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=33&wv=4.43.0&cb=26283926058

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.131 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ad6aa18e132c373e6a0be7543103d4e5dfde8680587cea250550686591419910

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 17 Jun 2022 07:35:34 GMT
content-encoding: gzip
server: Finatra
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://wheregoes.com
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 44

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
905 B 188ms
142ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CU18831I
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: b7da99b0935e79ff999cf7b20ea1766531e3ff634842630120ce5986462d5ced

Request headers

Referer: https://wheregoes.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:34 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
via: 1.1 google

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 73ms
27ms Script
application/javascript 2a00:1450:4001:82b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Jun 2022 07:35:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 80ms
32ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=wheregoes.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Jun 2022 07:35:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 20 KB
9 KB 116ms
73ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2042852008059290&correlator=3599228930383501&output=ldjh&gdfp_req=1&vrg=2022060901&ptt=17&impl=fifs&iu_parts=8691100%2CWheregoes_S2S_Leaderboard_InContent_BTF_ROS&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C300x250%7C336x280&fluid=height&ifi=1&adks=3878002045&sfv=1-0-38&ecs=20220617&fsapi=false&prev_scp=optimize_ad_unit_id%3Dbsa-zone_1641318314037-7_123456%26optimize_inview%3Dfalse%26optimize_refresh_int%3D0&eri=1&cust_params=optimize_refreshed%3Dfalse%26optimize_acceptable%3Dfalse%26optimize_adl_debug%3Dfalse%26optimize_ctv_debug%3Dfalse%26optimize_debug%3Dfalse%26optimize%3Dtrue%26optimize_adl_id%3D%26optimize_amp%3Dfalse%26optimize_audience%3Dtech%26optimize_env%3Dprod%26optimize_pub%3Dwheregoes%26optimize_xp%3Da&sc=1&cookie_enabled=1&abxe=1&dt=1655451335238&lmt=1655451335&dlt=1655451333546&idt=855&biw=1600&bih=1200&adxs=436&adys=965&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1182x952&msz=1182x250&fws=0&ohw=0&ga_vid=84201263.1655451335&ga_sid=1655451335&ga_hid=112455415&ga_fc=false&btvi=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060901.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8e3b8d3352205d0b48009c006b6991039042417a3e7358651502f01e9c76cbde

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:35 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9490
x-xss-protection: 0
google-lineitem-id: 5320060794
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138305491763
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://wheregoes.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 36ms
35ms XHR
application/json 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022060901&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

3a8a87fa988a665c36f226c63937787ef695d0169805492403abc7a715059c09

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Jun 2022 07:35:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10632
x-xss-protection: 0

GET
H2 200 container.html Show response
86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8BF3 6 KB
4 KB 105ms
26ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Jun 2022 07:35:35 GMT
expires: Sat, 17 Jun 2023 07:35:35 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 96ms
27ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060901.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Jun 2022 07:35:35 GMT

GET
H3 200 container.html Show response
86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 532A 6 KB
3 KB 61ms
20ms Document
text/html 2a00:1450:4001:802::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022060901.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 17 Jun 2022 07:35:35 GMT
expires: Sat, 17 Jun 2023 07:35:35 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 4EEB 13 KB
5 KB 62ms
19ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 39928
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 16 Jun 2022 20:30:07 GMT
expires: Fri, 16 Jun 2023 20:30:07 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2F07 783 B
1 KB 78ms
33ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

9c15c601f1252fc862f95d89aa5fd07d7ca60bc773e80adaf55da649d3b85f4c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BmXQ6YaI0fxfBw4brCbOnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-BmXQ6YaI0fxfBw4brCbOnw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 17 Jun 2022 07:35:35 GMT
expires: Fri, 17 Jun 2022 07:35:35 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 532A 22 KB
7 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com
URL: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 07:19:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173775
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 15 Jun 2023 07:19:20 GMT

GET
H/1.1

200
OK

bounce Show response
secure.adnxs.com/ Frame 532A
Redirect Chain

https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=208470659&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsvWxqwJ9E1sQ6LMxljuMXcBrg_aZFBx9F8ZZHt2guSINXCyzrTAltNgYh7vmW...
https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D728x90%26cb%3D208470659%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjsvWxqwJ9E1sQ6LMxljuMX...

8 KB
4 KB

48ms
46ms

Script
application/javascript

37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D728x90%26cb%3D208470659%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjsvWxqwJ9E1sQ6LMxljuMXcBrg_aZFBx9F8ZZHt2guSINXCyzrTAltNgYh7vmWxu4pgKPFUah8Bn6_S7fWJu3TmJt-303NUfQ2HpvsU3SnpZ41NQuUvu-tjXqajz9NuRTATYiFjub9sLGO-U-8G1bZGCxK-HBJ9ohTKhrQHB1g8zmUvi_Ibew_uoq6vSqNXFj20hPF8hS-qpy70zaWu2qegMRVHJHQjH0ouX4_B_1NAWGwL0jqTzrTUbpUoKdokKaE3TH3ISbDc7eWQkof4SZgf6pBB1gbcZr07W1UxIFjdzKAMyMcG2ke0v4tdmG6TCvnMZPmU7MBR-mLuInJYaDZ1h2g%252526sai%25253DAMfl-YRi4YbFWlMt3FVrDn0Noys-a9V81RusM7w-O4QwbB6VA5NZK1KGsg0yGm45D6BqqMjjTzok0bf7_wdxQMU5ZuKyqhGgk8D4y91O9FJ1fdqlcF7QvR8XCv9kWLcCibfm%252526sig%25253DCg0ArKJSzE053rzgCeoVEAE%252526fbs_aeid%25253D%25255Bgw_fbsaeid%25255D%252526urlfix%25253D1%252526adurl%25253D

Requested by

Host: 86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com
URL: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4bb7cee823a4aa6165f5f40a55bc332eff28cedc1c6f123f0856ec34d8ff3343

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Fri, 17 Jun 2022 07:35:35 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 263593cd-cb74-429c-add7-e84e8b315618
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:35 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: d6ce0155-8d45-4f67-9c97-6d7421255666
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fttj%3Fid%3D18678115%26size%3D728x90%26cb%3D208470659%26pubclick%3Dhttps%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%25253Fxai%25253DAKAOjsvWxqwJ9E1sQ6LMxljuMXcBrg_aZFBx9F8ZZHt2guSINXCyzrTAltNgYh7vmWxu4pgKPFUah8Bn6_S7fWJu3TmJt-303NUfQ2HpvsU3SnpZ41NQuUvu-tjXqajz9NuRTATYiFjub9sLGO-U-8G1bZGCxK-HBJ9ohTKhrQHB1g8zmUvi_Ibew_uoq6vSqNXFj20hPF8hS-qpy70zaWu2qegMRVHJHQjH0ouX4_B_1NAWGwL0jqTzrTUbpUoKdokKaE3TH3ISbDc7eWQkof4SZgf6pBB1gbcZr07W1UxIFjdzKAMyMcG2ke0v4tdmG6TCvnMZPmU7MBR-mLuInJYaDZ1h2g%252526sai%25253DAMfl-YRi4YbFWlMt3FVrDn0Noys-a9V81RusM7w-O4QwbB6VA5NZK1KGsg0yGm45D6BqqMjjTzok0bf7_wdxQMU5ZuKyqhGgk8D4y91O9FJ1fdqlcF7QvR8XCv9kWLcCibfm%252526sig%25253DCg0ArKJSzE053rzgCeoVEAE%252526fbs_aeid%25253D%25255Bgw_fbsaeid%25255D%252526urlfix%25253D1%252526adurl%25253D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 532A 137 KB
42 KB 86ms
34ms Script
text/javascript 2a00:1450:400e:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com
URL: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d43af314f4a32ff8d1981c5319400f692c2cab96494705a9ec46cb1c45483ee5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43182
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1655318790223595"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Jun 2022 07:35:35 GMT

GET
H3 200 Fp7ECwttPu2Qt8V9RhmSdP8PTUkobZWfkzIiSeRIuag.js Show response
pagead2.googlesyndication.com/bg/ Frame 4EEB 36 KB
14 KB 24ms
20ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Fp7ECwttPu2Qt8V9RhmSdP8PTUkobZWfkzIiSeRIuag.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

169ec40b0b6d3eed90b7c57d46199274ff0f4d49286d959f93322249e448b9a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Thu, 16 Jun 2022 06:41:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 89660
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13866
x-xss-protection: 0
last-modified: Fri, 10 Jun 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 16 Jun 2023 06:41:15 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 532A 0
0 60ms
60ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvXSWFcQYCMyegbersfZhnq7ZFWYrN5EQ5NrbOe9Ps3n_WA5VCLupsI-2dujNqXJGaAHEwCTzbEdNpbmUnON2BSy_hKaBOmpzvEFm640n67l_13mVdfCmOwKHg3mzHBFM_vGkTl48LV4NGfgWCrHa3YzRjnxxy3kqpPePavDcVzJgUIn-SR3UkUorL2t5fBYz-M8TGCylibsnQRFpz5CLPsiDh2-aY5PPDHb2z5tMvkK-16d_jSYJbve31nXmAKjY-V_fRlaxWMXe7CNvXCaNUUb-Buor0Oq7ldXlPp8Y463T2uBxbbINeQcYpn6uizzdACK5paoSsa-jl-bjHauZ6SqBK1ZQ&sai=AMfl-YRB9msHRe4K7DM9Jr7sa8ZUQyajEhgYQsUbDYQAd-Sj8kqD6k8mAA9u6lLurAMMD5IRh9mE21oluICUqTYSyiZAY35_Dufhex6pIqmgqz2DLT-X_hSKXbZg2_HK3x1d&sig=Cg0ArKJSzDRTQT_1PKxaEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com
URL: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Jun 2022 07:35:35 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 17 Jun 2022 07:35:35 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2F07 0
0 71ms
71ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022060901&jk=2042852008059290&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

GET
H2 200 sync Show response
gum.criteo.com/ Frame 532A 51 B
377 B 99ms
32ms Script
text/javascript 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sync?c=30&r=2&j=cr_handle_data_a

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?id=18678115&size=728x90&cb=208470659&pubclick=https://adclick.g.doubleclick.net/pcs/click%253Fxai%253DAKAOjsvWxqwJ9E1sQ6LMxljuMXcBrg_aZFBx9F8ZZHt2guSINXCyzrTAltNgYh7vmWxu4pgKPFUah8Bn6_S7fWJu3TmJt-303NUfQ2HpvsU3SnpZ41NQuUvu-tjXqajz9NuRTATYiFjub9sLGO-U-8G1bZGCxK-HBJ9ohTKhrQHB1g8zmUvi_Ibew_uoq6vSqNXFj20hPF8hS-qpy70zaWu2qegMRVHJHQjH0ouX4_B_1NAWGwL0jqTzrTUbpUoKdokKaE3TH3ISbDc7eWQkof4SZgf6pBB1gbcZr07W1UxIFjdzKAMyMcG2ke0v4tdmG6TCvnMZPmU7MBR-mLuInJYaDZ1h2g%2526sai%253DAMfl-YRi4YbFWlMt3FVrDn0Noys-a9V81RusM7w-O4QwbB6VA5NZK1KGsg0yGm45D6BqqMjjTzok0bf7_wdxQMU5ZuKyqhGgk8D4y91O9FJ1fdqlcF7QvR8XCv9kWLcCibfm%2526sig%253DCg0ArKJSzE053rzgCeoVEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

acb5d519051cc13618e992a7df4bce6a980036dfbe2e17a970ec716194329f6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:35 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=3600
server-processing-duration-in-ticks: 1508
strict-transport-security: max-age=31536000; preload;
content-length: 169
expires: 60

GET
H/1.1 200
OK ttj Show response
secure.adnxs.com/ Frame 532A 8 KB
7 KB 174ms
174ms Script
application/javascript 37.252.173.62
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/ttj?ttjb=1&bdc=1655451335&bdh=Ge9n3BV-bWdBJTqYLZf14lm-6RM.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=208470659&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsvWxqwJ9E1sQ6LMxljuMXcBrg_aZFBx9F8ZZHt2guSINXCyzrTAltNgYh7vmWxu4pgKPFUah8Bn6_S7fWJu3TmJt-303NUfQ2HpvsU3SnpZ41NQuUvu-tjXqajz9NuRTATYiFjub9sLGO-U-8G1bZGCxK-HBJ9ohTKhrQHB1g8zmUvi_Ibew_uoq6vSqNXFj20hPF8hS-qpy70zaWu2qegMRVHJHQjH0ouX4_B_1NAWGwL0jqTzrTUbpUoKdokKaE3TH3ISbDc7eWQkof4SZgf6pBB1gbcZr07W1UxIFjdzKAMyMcG2ke0v4tdmG6TCvnMZPmU7MBR-mLuInJYaDZ1h2g%2526sai%253DAMfl-YRi4YbFWlMt3FVrDn0Noys-a9V81RusM7w-O4QwbB6VA5NZK1KGsg0yGm45D6BqqMjjTzok0bf7_wdxQMU5ZuKyqhGgk8D4y91O9FJ1fdqlcF7QvR8XCv9kWLcCibfm%2526sig%253DCg0ArKJSzE053rzgCeoVEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.62 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

024fa91fbd4a2fa55953db0d86e4e0355e3d988f225e860a826e9fbc4db35d74

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Fri, 17 Jun 2022 07:35:35 GMT
Content-Encoding: gzip
X-Creative-ID: 78827815
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 4f5cf73a-beb2-4c09-a221-1deacfd91532
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 4EEB 0
9 B 31ms
18ms Image
text/plain 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?gG-BCg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H/1.1 200
OK if Show response
fra1-ib.adnxs.com/ Frame 9F85 10 KB
6 KB 73ms
22ms Document
text/html 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QK9N_BMvRsAAAMA1gAFAQjH3bCVBhCXnYq1wfWryhMY36DG4cKIy5lrKjYJAaPLm8O1ij8RQbrYtFIIhD8ZAAAAIIXrwT8hQbrYtFIIhD8pAaMJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXiH1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGbBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0EwJEQUtBT2pzdld4cXdKOUUxc1E2TE14bGp1TVhjQnJnX2FaRkJ4OUY4WlpIdDJndVNJTlhDeXpyVEFsdE5nWWg3dm1XeHU0cGdLUEZVYWg4Qm42X1M3ZldKdTNUbUp0LTMwM05VZlEySHB2c1UzU25wWjQxTlF1VXZ1LXRqWHFhano5TnVSVEFUWWlGanViOXNMR08tVS04RzFiWkdDeEstSEJKOW9oVEtoclFIQjFnOHptVXZpX0liZXdfdW9xNnZTcU5YRmoyMGhQRjhoUy1xcHk3MHphV3UycWVnTVJWSEpIUWpIMG91WDRfQl8xTkFXR3dMMGpxVHpyVFVicFVvS2Rva0thRTNUSDNJU2JEYzdlV1Frb2Y0U1pnZjZwQkIxZ2JjWnIwN1cxVXhJRmpkektBTXlNY0cya2UwdjR0ZG1HNlRDdm5NWlBtVTdNQlItbUx1SW5KWWFEWjFoMmclMjUyNnNhaSUyNTNEQU1mbC1ZUmk0WWJGV2xNdDNGVnJEbjBOb3lzLWE5VjgxUnVzTTd3LU80UXdiQjZWQTVOWksxS0dzZzB5R200NUQ2QnFxTWpqVHpvazBiZjdfd2R4UU1VNVp1S3lxaEdnazhENHk5MU85RkoxZmRxbGNGN1F2UjhYQ3Y5a1dMY0NpYmZtJTI1MjZzaWclMjUzRENnMEFyS0pTekUwNTNyemdDZW9WRUFFBbUcZmJzX2FlaWRFJSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeAUkADEFNxBhZHVybAUQNPABANgCAOACn_A_6gIWRal8Oi8vd2hlcmVnb2VzLmNvbS_yAgwKBkhFSUdIVBICOTABD_DtBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhcKCklGUkFNRV9LRVkSCTk5MTE5MTY5N_ICvxUKC1BSRV9TQ1JJUFRTEq8VPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50aV49AGRrPUFycmF5LnByb3RvdHlwZS5pbmRleE9mPxW6LGEsYyl7cmV0dXJuIFotABAuY2FsbAEpJCx2b2lkIDApfTo2PwA0aWYoInN0cmluZyI9PT0BaBBvZiBhKQlWERoAIRUaSGN8fDEhPWMubGVuZ3RoPy0xOmERmFAoYywwKTtmb3IodmFyIGQ9MDtkPGENKVw7ZCsrKWlmKGQgaW4gYSYmYVtkXT09PWMNaAggZDsJcQwtMX07EaA4IGwoYSl7bFsiICJdKGEpDSIIIGF9CRMAPREoCCgpex01AG4BNQRhPQnuOD09PWE_ZG9jdW1lbnQ6YRVDJC5jcmVhdGVFbGUBGRgoImltZyIpHUUAcCUycGQpe2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7IQAUYj1uKGEuEXwEKTsB_QQpewEaAGUuugAZFwRmPVpTADwsZz1rKGYsYik7MDw9ZyYmPuoBFHNwbGljZSnpdGYsZywxKX1iLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGUsITEpO1IjAGI6ABBlcnJvcg07GH07Yi5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAHGIuc3JjPWM7WjEBGC5wdXNoKGIu0QEEcSgpfARhPTGSIC5jdXJyZW50U4UPTRoAKDI5AixudWxsOmEpJiYiNzdhHWxhLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RR3wUnI9UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0aW9uIHQoEeAAaAVhDGM9W10FCQRkPQHGDDtkb3tBexhiPWE7dHJ5BQwAZUGTGGU9ISFiJiYBJBwhPWIubG9jYaEUIC5ocmVmKWI6ewEtkGwoYi5mb28pO2U9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZT0hMX0BXghmPWUZFwBmARYMaWYoZgmZAGc-XgAMO2Q9YnUfIfQ1QiRyZWZlcnJlcnx8AZckfWVsc2UgZz1kLA3LAGMp3zBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9MfX13aGlsZShhJiZiIT1hKTtiPTCFqQBhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1oISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwArQwAPR11ACmhLxRhPTE7YTyxVEw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGgZqyHVZeUAZyUWJQIEZD0yBAEcMDw9ZDstLWShrEhmPWNbZF0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGQV5gQmJgHMATsEOzBBZSVaCCYmZAVIARsIKTtjBa0QdihiLGe16BRjLmc_Yy4F-gw6Yy5pAUAAfbHzBCB2oaEcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQq9-gB3lSkUdCgpLGM92d48Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4IKX19DuIIFqoIKCAwPD1jP2Euc3ViFj8JHCgwLGMpOmF9CeAMLnJmbC7oBw01aGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtQzVMOU9tdFU5czc5QnItbE5LMXZfUXlHa2JwVld0ZWVWcVZmUnNvbDlieDZKaXNUNFRPa2dYMXRrMXZtU2hWVTJQWG9GeEFYRy0tSnhsX0I3VWhYbG43bE9TU2ciIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqoZGlzcGxheTpub25lIj48L2Rpdj7yApkBCgxQT1NUX1NDUklQVFMSiAE8cyVqNggBFvYJFGFkcy5nLjpJDzEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMAPp0kICB7cjNweCgnOR6cDBwnKTt9KSgpOz3qEJQSChBIAZ00UE9SVF9QQVJBTVMS_xGRI4qUAPBtYWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTIxNy4xMTQuMjE4LjIxJm91dHB1dD0OfQ0gJnVudmlld2VkDpcNRYsgX3N0YXJ0PTEmoXYRvDb0DRAmc3ViXw2H9F4BYmlkZGVyLTMwNTY0NDcmaGw9ZGUmYWNlaWQ9TUZrWXRBQnJHN1FBdkJ1MEFQbFZOQUg2V0RRQk5YTTBBUkIxTkFIbWRqUUJuM2MwQWJaM05BSE5kelFCWkhnMEFkaDROQUVJZVRRQkZuazBBV1I1TkFHdWVUUUIySGswQWVaNU5BRUZlalFCQjNvMEFRaDZOQUVKZWpRQkNubzBBUk42TkFFWGVqUUJHWG8wQVJ4Nk5BRW9lalFCTUhvMEFUaDZOQUZMYzBFQlUzTkJBYUlOMmdFZmhBY0NpQjVjQW9zZVhBTEQ4bTBDSjBLcUFpaENxZ0ljVWFvQ29XQ3FBanRpcWdJU2FLb0NYbXlxQXBwNnFnTFBlcW9DallxcUFuR1BxZ0tBbTZvQ2dadXFBb0ticWdMeHBLb0NqYWVxQXFLb3FnSzN0Nm9DZk0ycUFtelNxZ0xSMWFvQzI5YXFBclRiASDwVTNLb0NWZDZxQWozaXFnTEo0cW9Db09XcUFuM3FxZ0lMN3FvQ3dQR3FBdjN5cWdMYjg2b0NpX1NxQXZQMXFnSk05cW9DUmZpcUFpYjdxZ0pDLTZvQ1NmAXD0AgIzX3FnTHZfNm9DUEFDckFrUUJxd0xuQWFzQ05nS3JBaFVEcXdMMUJLc0Nwd1dyQWhJSHF3SldCNnNDWkFlckFtWUhxd0t5QjZzQzVRaXJBb01KcXdKdkRLc0NSQTJyQXM4TnF3S0VFYXNDblJHckF0c1Jxd0lqRTZzQ094T3JBdFlXcXdJcEY2c0NweGVyQW5rWXF3TEFvVFVSenFFMUVkQ1QteEsxb2ZzU0NhajdFdG10LXhLNHhfc1NMOG43RWtyTy14TE8wZnNTQ2VqN0VxcnYteEtlOVBzU3ZQVDdFdDMwLXhMdTlQc1NLX2Y3RWhmNC14SUotX3NTUnZ2N0VsTDcteElEX2ZzU1c1X3FGTEQxQXhYNlZtc2FXd0NTS1hfTHRTNUhHd2RxJmV4az05OTExOTE2OTcmYXdiaWRfYz1BS0FtZi1CaHV2VlowaS02eXJFVWFoVDF2by1KRGxnUXZyM2MwVkNjckFHMU1SSmhRVjEzeDhMcHJXOEgxR1c5Q0lseHlNeW9jMEVKSDVKU2UycDVHVXZIR2xCelZEUmlieDdmcE9lYW1qUHRCR25USGxTVGI4dVcxcWd5VDkyZXJObjBjZGgwZEdsd3Q5U294ckZpMjZLdnZqYnZiQ29sVHJRNGxjb09fOHdacjNQeFIxTHYzSEEmYXdiaWRfZD1BS6Xy9LUEMGJqTy1fNXlpd2h0azVueXUxSUxlMUVuemdkb1EwbUhXZ0RBTUpEeVhzbkJjcG42T0N5Q09iV3NaNjAwSmJCUmdWWkhwU1ZqZFZ5WHRKdU0wOXM2dHhnSnZYcmlXN05oekpfU2t2ZWRwdmhUWlNmU0tUNzVYYWU4d3I1YlRTcXgweC1kN3R5QmNhMkJVT0FVQWFhMEZfam1RSVIyZEFvYUpfSkxqSDZkNGZiLURKOGJGSmZZVE9HRl8wdktLQ1RSSGsxX09QMUlJOWNXWGtkLTJ5MkNBSVVhdmRpZWlUQkhCQXRYTkVOcGxqTDVKRnhZbXcxNExKN0R6WDR2QTZpMjFodVlfWU0xUlVaX1ZzWGZXeWVub3ZCX3ZmYWIzNHctUzVzVDRVZWswMzRpaWhCRDQwc0hMNHpoa2gwOElORmNxQUR4U0MxeDRKWXBINXc3c0ZpS3dkVW53RzRPbnVGdDBfS2xtYjhITE9rbi1Nc3FTUjA3V3RQUnZ0VDJHZDV1ZVA4X19zNmM5V2gwT2w5cE9KYk1rYmhYYmhqUlF5TklHelpsX0dsTkw3SlRncElyTFR5M0pJNU1CdzVGc1B5aVhua056akpPU0V1TDQyaGVURGlwYzRWMmdhUjB3UUMtd3g5TVY0U21LRmFYb3VndUZjbFRDanR5eGpaUTRmMER5THIxd2tpRkxMbGY0WHlEZWtIcGE0OVJXNDd0eG1yTDM4VXZIeTFuZ29qSm02YkI0bFo3a2xUTXExMnpsR2lSWDRfQ3Rhd0pRTEFLVXhzY3JUZ1Bqdk0yUV9DQ3YyT2otcWhlUDBZWVAtSUx1UF9icEtDdkszVUtzNlJBVVd6V3dxenQ2ejNVdGZkWnQxaFBkZ1dONFowX09sMHY3VnUyc1ZaOEswNEFzT19NRFlhbGN4a0lzRG55M18xR0Y2RWc3YjFmY0ZBX2dSU2toLTFsMmVZV1VmVTAyYVZYYlZ5Sl9peU1QUFNDcnlMSWFZN29TTlRZZy1xSUNwTThrMk1Bdkk4ZHVkcm9ZNEVkYTJpcXVKdXNCZlpNYVY2RDFJNHA5S0RQSWZuTzVTV2w4ZnVWVXh0TE02Vnl1ZDhGcERPVkZKTWkzSHVJWTdlMEg4cjZDOE5RRW9zXzY3YjNZSUN1TnhvQm9QSVVDSEdqaGpoUTk2NXo1NVA5MDVYN3dOUWplbXAyNWktQ3cyREYzVl9DRXlaZkhsendibmtwSDV0TTZKYTlXZjJyTWZISnNqeDAway1ra3RnSWJhNEdTT25Xdy1wLXJQVG55ZDd0Nm1KN09xYUZWYjdIZVFSd1FQUkMxbTkwd0NLYkNpM25lQ3N3ZFFiUTRBVWpWcE1QZVpBSE5pMkx1bWlGYkJMRUxOM2V2RV8yZmpudkxnQ1Zpdk9VemxDVUNLdksxSjlOa3JGN2JjYUlrLWNhSGVfWTZyTlYxN0JGZCZjaWQ9Q0FBU0JPUm82X3cmYV9jaWQ9gAMAiAMBkAMAmAMZoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfHrEK9FMBQmdtM3dOZmw3SXZPWExuVzlMTWYwTXNxbnIwWno3RUplbVN4aDNPY3BjRWJFcWdQOS1Va2tvOGp6S2hZOE43SzU5dm93R2ZSN21pNGVIZ1ZDdFJWZENBOEV6bncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTQxMDk0NTczNjkyMjc5NTY3MSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDjIxNy4xMTQuMjE4LjIxqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBeXht9yzurGuTcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBazYRvoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAA08qAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHCzE2NTcxNjY2MTc3ugcPCAABKAWyML8GQADIB4fWBdIHDQkBQgEBAR4I2gcGCSdo4AcA6gcCCADwB5H4AYoIAhAAlQgAAIA_mAgB&s=9c2a9fffdb4ea8834fede4fefc85204ed89783f6

Requested by

Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1655451335&bdh=Ge9n3BV-bWdBJTqYLZf14lm-6RM.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=208470659&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsvWxqwJ9E1sQ6LMxljuMXcBrg_aZFBx9F8ZZHt2guSINXCyzrTAltNgYh7vmWxu4pgKPFUah8Bn6_S7fWJu3TmJt-303NUfQ2HpvsU3SnpZ41NQuUvu-tjXqajz9NuRTATYiFjub9sLGO-U-8G1bZGCxK-HBJ9ohTKhrQHB1g8zmUvi_Ibew_uoq6vSqNXFj20hPF8hS-qpy70zaWu2qegMRVHJHQjH0ouX4_B_1NAWGwL0jqTzrTUbpUoKdokKaE3TH3ISbDc7eWQkof4SZgf6pBB1gbcZr07W1UxIFjdzKAMyMcG2ke0v4tdmG6TCvnMZPmU7MBR-mLuInJYaDZ1h2g%2526sai%253DAMfl-YRi4YbFWlMt3FVrDn0Noys-a9V81RusM7w-O4QwbB6VA5NZK1KGsg0yGm45D6BqqMjjTzok0bf7_wdxQMU5ZuKyqhGgk8D4y91O9FJ1fdqlcF7QvR8XCv9kWLcCibfm%2526sig%253DCg0ArKJSzE053rzgCeoVEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

8568c97d851d34bd48f721cbb423e709042a33835847e37ef6a68268104c478b

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

AN-X-Request-Uuid: dc0e8d3d-184d-4480-99c0-2c2ae42cb970
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Fri, 17 Jun 2022 07:35:35 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.21.3
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Creative-ID: 78827815
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame CA57 52 KB
17 KB 69ms
19ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141
Requested by: Host: secure.adnxs.com
URL: https://secure.adnxs.com/ttj?ttjb=1&bdc=1655451335&bdh=Ge9n3BV-bWdBJTqYLZf14lm-6RM.&&bdref=https%3A%2F%2Fwheregoes.com%2F&bdtop=true&bdifs=1&bstk=https%3A%2F%2Fwheregoes.com%2F,https%3A%2F%2F86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-38%2Fhtml%2Fcontainer.html&&id=18678115&size=728x90&cb=208470659&pubclick=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%253Fxai%253DAKAOjsvWxqwJ9E1sQ6LMxljuMXcBrg_aZFBx9F8ZZHt2guSINXCyzrTAltNgYh7vmWxu4pgKPFUah8Bn6_S7fWJu3TmJt-303NUfQ2HpvsU3SnpZ41NQuUvu-tjXqajz9NuRTATYiFjub9sLGO-U-8G1bZGCxK-HBJ9ohTKhrQHB1g8zmUvi_Ibew_uoq6vSqNXFj20hPF8hS-qpy70zaWu2qegMRVHJHQjH0ouX4_B_1NAWGwL0jqTzrTUbpUoKdokKaE3TH3ISbDc7eWQkof4SZgf6pBB1gbcZr07W1UxIFjdzKAMyMcG2ke0v4tdmG6TCvnMZPmU7MBR-mLuInJYaDZ1h2g%2526sai%253DAMfl-YRi4YbFWlMt3FVrDn0Noys-a9V81RusM7w-O4QwbB6VA5NZK1KGsg0yGm45D6BqqMjjTzok0bf7_wdxQMU5ZuKyqhGgk8D4y91O9FJ1fdqlcF7QvR8XCv9kWLcCibfm%2526sig%253DCg0ArKJSzE053rzgCeoVEAE%2526fbs_aeid%253D%255Bgw_fbsaeid%255D%2526urlfix%253D1%2526adurl%253D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 11280
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 17 Jun 2022 07:35:35 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 17 Jun 2022 04:27:36 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1, 145750
X-Served-By: cache-lga13629-LGA, cache-hhn4062-HHN
X-Timer: S1655451336.816979,VS0,VE0

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 532A 0
0 96ms
55ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjst9Hc6y6cTlwxkqglVVypDrurEbQKX4PWpvxD53pXRT9yzYd5Jk6vIdRhu1NUrqNkgE97fSxk7TaHR1y4zwLrZKp1yLlZbRNgjMRr6Lp2dTDdb9oHKCTpWEuer4XOzfEYH6DEMW-QBtGpVJsLequNqQfude7XhR3w_f-q3rskMVPzFXIyb994vYj7FSOj5kyQ0_DugMjg5OQBPFh2cZNayR_ijIE0dDyo7clEkyTK8lenCe6gvpkOAupI8452Fz5SJX7UE_ijSzcEFXJCROW4QABdFDbGCUwvCJxlavDB24rw0y8vdjkHZJTZY5hwLx6MbMugsj_8qqST9saq-I6i9PMRWGc2eD&sai=AMfl-YSu9DPYGQeFcAYTkpDuQwiJV_WfaGEcZyVDFKjmxwaicQ1ICm2NCS2aKC28ayZIJP4yQyNYK7GW_posX-VXHI0aCH3KRnKols1XYSJFlG14v0enT9dNw6sYkXlEMBW2&sig=Cg0ArKJSzKw3ctUiy-xSEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
date: Fri, 17 Jun 2022 07:35:35 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe
expires: Fri, 17 Jun 2022 07:35:35 GMT

GET
DATA 200
OK truncated
/ Frame 532A 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 73bca1afcc29fe20191dba2aa55f11d1500fb286ae7005563539f48ee81c4101

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame CA57 0
745 B 21ms
21ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:35 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 16e8801c-9d47-4410-a5f9-38500f49ceab
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9F85 0
20 B 53ms
52ms Image
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=awbid&awbid_b=AKAmf-C5L9OmtU9s79Br-lNK1v_QyGkbpVWteeVqVfRsol9bx6JisT4TOkgX1tk1vmShVU2PXoFxAXG--Jxl_B7UhXln7lOSSg

Requested by

Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QK9N_BMvRsAAAMA1gAFAQjH3bCVBhCXnYq1wfWryhMY36DG4cKIy5lrKjYJAaPLm8O1ij8RQbrYtFIIhD8ZAAAAIIXrwT8hQbrYtFIIhD8pAaMJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXiH1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGbBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0EwJEQUtBT2pzdld4cXdKOUUxc1E2TE14bGp1TVhjQnJnX2FaRkJ4OUY4WlpIdDJndVNJTlhDeXpyVEFsdE5nWWg3dm1XeHU0cGdLUEZVYWg4Qm42X1M3ZldKdTNUbUp0LTMwM05VZlEySHB2c1UzU25wWjQxTlF1VXZ1LXRqWHFhano5TnVSVEFUWWlGanViOXNMR08tVS04RzFiWkdDeEstSEJKOW9oVEtoclFIQjFnOHptVXZpX0liZXdfdW9xNnZTcU5YRmoyMGhQRjhoUy1xcHk3MHphV3UycWVnTVJWSEpIUWpIMG91WDRfQl8xTkFXR3dMMGpxVHpyVFVicFVvS2Rva0thRTNUSDNJU2JEYzdlV1Frb2Y0U1pnZjZwQkIxZ2JjWnIwN1cxVXhJRmpkektBTXlNY0cya2UwdjR0ZG1HNlRDdm5NWlBtVTdNQlItbUx1SW5KWWFEWjFoMmclMjUyNnNhaSUyNTNEQU1mbC1ZUmk0WWJGV2xNdDNGVnJEbjBOb3lzLWE5VjgxUnVzTTd3LU80UXdiQjZWQTVOWksxS0dzZzB5R200NUQ2QnFxTWpqVHpvazBiZjdfd2R4UU1VNVp1S3lxaEdnazhENHk5MU85RkoxZmRxbGNGN1F2UjhYQ3Y5a1dMY0NpYmZtJTI1MjZzaWclMjUzRENnMEFyS0pTekUwNTNyemdDZW9WRUFFBbUcZmJzX2FlaWRFJSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeAUkADEFNxBhZHVybAUQNPABANgCAOACn_A_6gIWRal8Oi8vd2hlcmVnb2VzLmNvbS_yAgwKBkhFSUdIVBICOTABD_DtBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhcKCklGUkFNRV9LRVkSCTk5MTE5MTY5N_ICvxUKC1BSRV9TQ1JJUFRTEq8VPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50aV49AGRrPUFycmF5LnByb3RvdHlwZS5pbmRleE9mPxW6LGEsYyl7cmV0dXJuIFotABAuY2FsbAEpJCx2b2lkIDApfTo2PwA0aWYoInN0cmluZyI9PT0BaBBvZiBhKQlWERoAIRUaSGN8fDEhPWMubGVuZ3RoPy0xOmERmFAoYywwKTtmb3IodmFyIGQ9MDtkPGENKVw7ZCsrKWlmKGQgaW4gYSYmYVtkXT09PWMNaAggZDsJcQwtMX07EaA4IGwoYSl7bFsiICJdKGEpDSIIIGF9CRMAPREoCCgpex01AG4BNQRhPQnuOD09PWE_ZG9jdW1lbnQ6YRVDJC5jcmVhdGVFbGUBGRgoImltZyIpHUUAcCUycGQpe2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7IQAUYj1uKGEuEXwEKTsB_QQpewEaAGUuugAZFwRmPVpTADwsZz1rKGYsYik7MDw9ZyYmPuoBFHNwbGljZSnpdGYsZywxKX1iLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGUsITEpO1IjAGI6ABBlcnJvcg07GH07Yi5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAHGIuc3JjPWM7WjEBGC5wdXNoKGIu0QEEcSgpfARhPTGSIC5jdXJyZW50U4UPTRoAKDI5AixudWxsOmEpJiYiNzdhHWxhLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RR3wUnI9UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0aW9uIHQoEeAAaAVhDGM9W10FCQRkPQHGDDtkb3tBexhiPWE7dHJ5BQwAZUGTGGU9ISFiJiYBJBwhPWIubG9jYaEUIC5ocmVmKWI6ewEtkGwoYi5mb28pO2U9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZT0hMX0BXghmPWUZFwBmARYMaWYoZgmZAGc-XgAMO2Q9YnUfIfQ1QiRyZWZlcnJlcnx8AZckfWVsc2UgZz1kLA3LAGMp3zBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9MfX13aGlsZShhJiZiIT1hKTtiPTCFqQBhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1oISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwArQwAPR11ACmhLxRhPTE7YTyxVEw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGgZqyHVZeUAZyUWJQIEZD0yBAEcMDw9ZDstLWShrEhmPWNbZF0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGQV5gQmJgHMATsEOzBBZSVaCCYmZAVIARsIKTtjBa0QdihiLGe16BRjLmc_Yy4F-gw6Yy5pAUAAfbHzBCB2oaEcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQq9-gB3lSkUdCgpLGM92d48Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4IKX19DuIIFqoIKCAwPD1jP2Euc3ViFj8JHCgwLGMpOmF9CeAMLnJmbC7oBw01aGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtQzVMOU9tdFU5czc5QnItbE5LMXZfUXlHa2JwVld0ZWVWcVZmUnNvbDlieDZKaXNUNFRPa2dYMXRrMXZtU2hWVTJQWG9GeEFYRy0tSnhsX0I3VWhYbG43bE9TU2ciIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqoZGlzcGxheTpub25lIj48L2Rpdj7yApkBCgxQT1NUX1NDUklQVFMSiAE8cyVqNggBFvYJFGFkcy5nLjpJDzEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMAPp0kICB7cjNweCgnOR6cDBwnKTt9KSgpOz3qEJQSChBIAZ00UE9SVF9QQVJBTVMS_xGRI4qUAPBtYWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTIxNy4xMTQuMjE4LjIxJm91dHB1dD0OfQ0gJnVudmlld2VkDpcNRYsgX3N0YXJ0PTEmoXYRvDb0DRAmc3ViXw2H9F4BYmlkZGVyLTMwNTY0NDcmaGw9ZGUmYWNlaWQ9TUZrWXRBQnJHN1FBdkJ1MEFQbFZOQUg2V0RRQk5YTTBBUkIxTkFIbWRqUUJuM2MwQWJaM05BSE5kelFCWkhnMEFkaDROQUVJZVRRQkZuazBBV1I1TkFHdWVUUUIySGswQWVaNU5BRUZlalFCQjNvMEFRaDZOQUVKZWpRQkNubzBBUk42TkFFWGVqUUJHWG8wQVJ4Nk5BRW9lalFCTUhvMEFUaDZOQUZMYzBFQlUzTkJBYUlOMmdFZmhBY0NpQjVjQW9zZVhBTEQ4bTBDSjBLcUFpaENxZ0ljVWFvQ29XQ3FBanRpcWdJU2FLb0NYbXlxQXBwNnFnTFBlcW9DallxcUFuR1BxZ0tBbTZvQ2dadXFBb0ticWdMeHBLb0NqYWVxQXFLb3FnSzN0Nm9DZk0ycUFtelNxZ0xSMWFvQzI5YXFBclRiASDwVTNLb0NWZDZxQWozaXFnTEo0cW9Db09XcUFuM3FxZ0lMN3FvQ3dQR3FBdjN5cWdMYjg2b0NpX1NxQXZQMXFnSk05cW9DUmZpcUFpYjdxZ0pDLTZvQ1NmAXD0AgIzX3FnTHZfNm9DUEFDckFrUUJxd0xuQWFzQ05nS3JBaFVEcXdMMUJLc0Nwd1dyQWhJSHF3SldCNnNDWkFlckFtWUhxd0t5QjZzQzVRaXJBb01KcXdKdkRLc0NSQTJyQXM4TnF3S0VFYXNDblJHckF0c1Jxd0lqRTZzQ094T3JBdFlXcXdJcEY2c0NweGVyQW5rWXF3TEFvVFVSenFFMUVkQ1QteEsxb2ZzU0NhajdFdG10LXhLNHhfc1NMOG43RWtyTy14TE8wZnNTQ2VqN0VxcnYteEtlOVBzU3ZQVDdFdDMwLXhMdTlQc1NLX2Y3RWhmNC14SUotX3NTUnZ2N0VsTDcteElEX2ZzU1c1X3FGTEQxQXhYNlZtc2FXd0NTS1hfTHRTNUhHd2RxJmV4az05OTExOTE2OTcmYXdiaWRfYz1BS0FtZi1CaHV2VlowaS02eXJFVWFoVDF2by1KRGxnUXZyM2MwVkNjckFHMU1SSmhRVjEzeDhMcHJXOEgxR1c5Q0lseHlNeW9jMEVKSDVKU2UycDVHVXZIR2xCelZEUmlieDdmcE9lYW1qUHRCR25USGxTVGI4dVcxcWd5VDkyZXJObjBjZGgwZEdsd3Q5U294ckZpMjZLdnZqYnZiQ29sVHJRNGxjb09fOHdacjNQeFIxTHYzSEEmYXdiaWRfZD1BS6Xy9LUEMGJqTy1fNXlpd2h0azVueXUxSUxlMUVuemdkb1EwbUhXZ0RBTUpEeVhzbkJjcG42T0N5Q09iV3NaNjAwSmJCUmdWWkhwU1ZqZFZ5WHRKdU0wOXM2dHhnSnZYcmlXN05oekpfU2t2ZWRwdmhUWlNmU0tUNzVYYWU4d3I1YlRTcXgweC1kN3R5QmNhMkJVT0FVQWFhMEZfam1RSVIyZEFvYUpfSkxqSDZkNGZiLURKOGJGSmZZVE9HRl8wdktLQ1RSSGsxX09QMUlJOWNXWGtkLTJ5MkNBSVVhdmRpZWlUQkhCQXRYTkVOcGxqTDVKRnhZbXcxNExKN0R6WDR2QTZpMjFodVlfWU0xUlVaX1ZzWGZXeWVub3ZCX3ZmYWIzNHctUzVzVDRVZWswMzRpaWhCRDQwc0hMNHpoa2gwOElORmNxQUR4U0MxeDRKWXBINXc3c0ZpS3dkVW53RzRPbnVGdDBfS2xtYjhITE9rbi1Nc3FTUjA3V3RQUnZ0VDJHZDV1ZVA4X19zNmM5V2gwT2w5cE9KYk1rYmhYYmhqUlF5TklHelpsX0dsTkw3SlRncElyTFR5M0pJNU1CdzVGc1B5aVhua056akpPU0V1TDQyaGVURGlwYzRWMmdhUjB3UUMtd3g5TVY0U21LRmFYb3VndUZjbFRDanR5eGpaUTRmMER5THIxd2tpRkxMbGY0WHlEZWtIcGE0OVJXNDd0eG1yTDM4VXZIeTFuZ29qSm02YkI0bFo3a2xUTXExMnpsR2lSWDRfQ3Rhd0pRTEFLVXhzY3JUZ1Bqdk0yUV9DQ3YyT2otcWhlUDBZWVAtSUx1UF9icEtDdkszVUtzNlJBVVd6V3dxenQ2ejNVdGZkWnQxaFBkZ1dONFowX09sMHY3VnUyc1ZaOEswNEFzT19NRFlhbGN4a0lzRG55M18xR0Y2RWc3YjFmY0ZBX2dSU2toLTFsMmVZV1VmVTAyYVZYYlZ5Sl9peU1QUFNDcnlMSWFZN29TTlRZZy1xSUNwTThrMk1Bdkk4ZHVkcm9ZNEVkYTJpcXVKdXNCZlpNYVY2RDFJNHA5S0RQSWZuTzVTV2w4ZnVWVXh0TE02Vnl1ZDhGcERPVkZKTWkzSHVJWTdlMEg4cjZDOE5RRW9zXzY3YjNZSUN1TnhvQm9QSVVDSEdqaGpoUTk2NXo1NVA5MDVYN3dOUWplbXAyNWktQ3cyREYzVl9DRXlaZkhsendibmtwSDV0TTZKYTlXZjJyTWZISnNqeDAway1ra3RnSWJhNEdTT25Xdy1wLXJQVG55ZDd0Nm1KN09xYUZWYjdIZVFSd1FQUkMxbTkwd0NLYkNpM25lQ3N3ZFFiUTRBVWpWcE1QZVpBSE5pMkx1bWlGYkJMRUxOM2V2RV8yZmpudkxnQ1Zpdk9VemxDVUNLdksxSjlOa3JGN2JjYUlrLWNhSGVfWTZyTlYxN0JGZCZjaWQ9Q0FBU0JPUm82X3cmYV9jaWQ9gAMAiAMBkAMAmAMZoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfHrEK9FMBQmdtM3dOZmw3SXZPWExuVzlMTWYwTXNxbnIwWno3RUplbVN4aDNPY3BjRWJFcWdQOS1Va2tvOGp6S2hZOE43SzU5dm93R2ZSN21pNGVIZ1ZDdFJWZENBOEV6bncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTQxMDk0NTczNjkyMjc5NTY3MSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDjIxNy4xMTQuMjE4LjIxqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBeXht9yzurGuTcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBazYRvoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAA08qAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHCzE2NTcxNjY2MTc3ugcPCAABKAWyML8GQADIB4fWBdIHDQkBQgEBAR4I2gcGCSdo4AcA6gcCCADwB5H4AYoIAhAAlQgAAIA_mAgB&s=9c2a9fffdb4ea8834fede4fefc85204ed89783f6

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:35 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xbfe_backfill.js Show response
googleads.g.doubleclick.net/pagead/ Frame 9F85 11 KB
5 KB 67ms
18ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/xbfe_backfill.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05fdf9059f82368fa058a4fed88c9b56263934d770af68ea301f57f80be88ca6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:15:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1195
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4665
x-xss-protection: 0
server: cafe
etag: 1690156577369591742
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=3600
timing-allow-origin: *
expires: Fri, 17 Jun 2022 08:15:40 GMT

GET
H/1.1 200
OK it
fra1-ib.adnxs.com/ Frame 9F85 0
817 B 96ms
96ms Image
text/html 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fra1-ib.adnxs.com/it?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKcC_BMnAUAAAMA1gAFAQjH3bCVBhCXnYq1wfWryhMY36DG4cKIy5lrKjYJAqPLm8O1ij8RQbrYtFIIhD8ZAAAAIIXrwT8hQbrYtFIIhD8pAaMJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXiH1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGbBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0EwJEQUtBT2pzdld4cXdKOUUxc1E2TE14bGp1TVhjQnJnX2FaRkJ4OUY4WlpIdDJndVNJTlhDeXpyVEFsdE5nWWg3dm1XeHU0cGdLUEZVYWg4Qm42X1M3ZldKdTNUbUp0LTMwM05VZlEySHB2c1UzU25wWjQxTlF1VXZ1LXRqWHFhano5TnVSVEFUWWlGanViOXNMR08tVS04RzFiWkdDeEstSEJKOW9oVEtoclFIQjFnOHptVXZpX0liZXdfdW9xNnZTcU5YRmoyMGhQRjhoUy1xcHk3MHphV3UycWVnTVJWSEpIUWpIMG91WDRfQl8xTkFXR3dMMGpxVHpyVFVicFVvS2Rva0thRTNUSDNJU2JEYzdlV1Frb2Y0U1pnZjZwQkIxZ2JjWnIwN1cxVXhJRmpkektBTXlNY0cya2UwdjR0ZG1HNlRDdm5NWlBtVTdNQlItbUx1SW5KWWFEWjFoMmclMjUyNnNhaSUyNTNEQU1mbC1ZUmk0WWJGV2xNdDNGVnJEbjBOb3lzLWE5VjgxUnVzTTd3LU80UXdiQjZWQTVOWksxS0dzZzB5R200NUQ2QnFxTWpqVHpvazBiZjdfd2R4UU1VNVp1S3lxaEdnazhENHk5MU85RkoxZmRxbGNGN1F2UjhYQ3Y5a1dMY0NpYmZtJTI1MjZzaWclMjUzRENnMEFyS0pTekUwNTNyemdDZW9WRUFFBbUcZmJzX2FlaWRFJSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeAUkADEFNxBhZHVybAUQNPABANgCAOACn_A_6gIWRamYOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqA-oBCr8BESxgcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbgU8CR5EL2dlbl8yMDQ_aWQ9YXdiaWQmBQb0SAFfYj1BS0FtZi1CZ20zd05mbDdJdk9YTG5XOUxNZjBNc3FucjBaejdFSmVtU3hoM09jcGNFYkVxZ1A5LVVra284anpLaFk4TjdLNTl2b3dHZlI3bWk0ZUhnVkN0UlZkQ0E4RXpudyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhMxNDEwOTQ1NzM2OTIyNzk1NjcxIgg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQOMjE3LjExNC4yMTguMjGoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF5eG33LO6sa5NwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFrNhG-gUECAAQAJAGAJgGALgGAMEGAAAAAAExJNAG7o8B2gYWChANNhUBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHCzE2NTcxNjY2MTc3ugcPCAUoRCAAMAA4vwZAAMgHh9YF0gcNCRFHAUYM2gcGCAUJaOAHAOoHAggA8AeR-AGKCAIQAJUIAACAP5gIAQ..&s=8405283ea6d642689e1bb3e14d2663524f926049

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:35 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8b1f3369-7d10-4e0f-aea3-e6005645f019
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trk.js Show response
cdn.adnxs.com/v/s/224/ Frame 9F85 85 KB
29 KB 117ms
36ms Script
application/x-javascript 23.35.236.188
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adnxs.com/v/s/224/trk.js
Requested by: Host: fra1-ib.adnxs.com
URL: https://fra1-ib.adnxs.com/if?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QK9N_BMvRsAAAMA1gAFAQjH3bCVBhCXnYq1wfWryhMY36DG4cKIy5lrKjYJAaPLm8O1ij8RQbrYtFIIhD8ZAAAAIIXrwT8hQbrYtFIIhD8pAaMJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXiH1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEBsAEAuAECwAEFyAEC0AEA2AEA4AEA6gGbBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0EwJEQUtBT2pzdld4cXdKOUUxc1E2TE14bGp1TVhjQnJnX2FaRkJ4OUY4WlpIdDJndVNJTlhDeXpyVEFsdE5nWWg3dm1XeHU0cGdLUEZVYWg4Qm42X1M3ZldKdTNUbUp0LTMwM05VZlEySHB2c1UzU25wWjQxTlF1VXZ1LXRqWHFhano5TnVSVEFUWWlGanViOXNMR08tVS04RzFiWkdDeEstSEJKOW9oVEtoclFIQjFnOHptVXZpX0liZXdfdW9xNnZTcU5YRmoyMGhQRjhoUy1xcHk3MHphV3UycWVnTVJWSEpIUWpIMG91WDRfQl8xTkFXR3dMMGpxVHpyVFVicFVvS2Rva0thRTNUSDNJU2JEYzdlV1Frb2Y0U1pnZjZwQkIxZ2JjWnIwN1cxVXhJRmpkektBTXlNY0cya2UwdjR0ZG1HNlRDdm5NWlBtVTdNQlItbUx1SW5KWWFEWjFoMmclMjUyNnNhaSUyNTNEQU1mbC1ZUmk0WWJGV2xNdDNGVnJEbjBOb3lzLWE5VjgxUnVzTTd3LU80UXdiQjZWQTVOWksxS0dzZzB5R200NUQ2QnFxTWpqVHpvazBiZjdfd2R4UU1VNVp1S3lxaEdnazhENHk5MU85RkoxZmRxbGNGN1F2UjhYQ3Y5a1dMY0NpYmZtJTI1MjZzaWclMjUzRENnMEFyS0pTekUwNTNyemdDZW9WRUFFBbUcZmJzX2FlaWRFJSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeAUkADEFNxBhZHVybAUQNPABANgCAOACn_A_6gIWRal8Oi8vd2hlcmVnb2VzLmNvbS_yAgwKBkhFSUdIVBICOTABD_DtBVdJRFRIEgM3MjjyAiEKBkxPQURFUhIXcmVuZGVyX3Bvc3RfYWRzX3YxLmh0bWzyAhcKCklGUkFNRV9LRVkSCTk5MTE5MTY5N_ICvxUKC1BSRV9TQ1JJUFRTEq8VPHNjcmlwdD4oZnVuY3Rpb24oKXsvKgoKIENvcHlyaWdodCBUaGUgQ2xvc3VyZSBMaWJyYXJ5IEF1dGhvcnMuCiBTUERYLUxpY2Vuc2UtSWRlbnRpZmllcjogQXBhY2hlLTIuMAoqLwp2YXIgaD10aGlzfHxzZWxmOy8qCgogU1BEWC1MaWNlbnNlLUlkZW50aV49AGRrPUFycmF5LnByb3RvdHlwZS5pbmRleE9mPxW6LGEsYyl7cmV0dXJuIFotABAuY2FsbAEpJCx2b2lkIDApfTo2PwA0aWYoInN0cmluZyI9PT0BaBBvZiBhKQlWERoAIRUaSGN8fDEhPWMubGVuZ3RoPy0xOmERmFAoYywwKTtmb3IodmFyIGQ9MDtkPGENKVw7ZCsrKWlmKGQgaW4gYSYmYVtkXT09PWMNaAggZDsJcQwtMX07EaA4IGwoYSl7bFsiICJdKGEpDSIIIGF9CRMAPREoCCgpex01AG4BNQRhPQnuOD09PWE_ZG9jdW1lbnQ6YRVDJC5jcmVhdGVFbGUBGRgoImltZyIpHUUAcCUycGQpe2EuZ29vZ2xlX2ltYWdlX3JlcXVlc3RzfHwoWhoAED1bXSk7IQAUYj1uKGEuEXwEKTsB_QQpewEaAGUuugAZFwRmPVpTADwsZz1rKGYsYik7MDw9ZyYmPuoBFHNwbGljZSnpdGYsZywxKX1iLnJlbW92ZUV2ZW50TGlzdGVuZXImJlIXADQoImxvYWQiLGUsITEpO1IjAGI6ABBlcnJvcg07GH07Yi5hZGRCcwA-FAA-cAA-IAABbT4UAAAoNmoAHGIuc3JjPWM7WjEBGC5wdXNoKGIu0QEEcSgpfARhPTGSIC5jdXJyZW50U4UPTRoAKDI5AixudWxsOmEpJiYiNzdhHWxhLmdldEF0dHJpYnV0ZSgiZGF0YS1qYyIpP2E6FVc8cXVlcnlTZWxlY3RvcignWw0lAD0BRAxdJyl9RR3wUnI9UmVnRXhwKCJeaHR0cHM_Oi8vKFxcd3wtKStcXC5jZG5cXC5hbXBwcm9qZWN0XFwuKG5ldHxvcmcpKFxcP3wvfCQpIik7CmZ1bmN0aW9uIHQoEeAAaAVhDGM9W10FCQRkPQHGDDtkb3tBexhiPWE7dHJ5BQwAZUGTGGU9ISFiJiYBJBwhPWIubG9jYaEUIC5ocmVmKWI6ewEtkGwoYi5mb28pO2U9ITA7YnJlYWsgYn1jYXRjaChtKXt9ZT0hMX0BXghmPWUZFwBmARYMaWYoZgmZAGc-XgAMO2Q9YnUfIfQ1QiRyZWZlcnJlcnx8AZckfWVsc2UgZz1kLA3LAGMp3zBuZXcgdShnfHwiIikpBdUUYT1iLnBhIdQZhgBhBf9MfX13aGlsZShhJiZiIT1hKTtiPTCFqQBhlcp0LTE7Yjw9YTsrK2IpY1tiXS5kZXB0aD1hLWI7Yj1oISs5HgGuNSo4YW5jZXN0b3JPcmlnaW5zbhwArQwAPR11ACmhLxRhPTE7YTyxVEw7KythKWc9Y1thXSxnLnVybHx8KAUILkIBOnYAFFthLQoxXSEMGCxnLmg9ITAB4ykiAGgZqyHVZeUAZyUWJQIEZD0yBAEcMDw9ZDstLWShrEhmPWNbZF0sIWcmJnIudGVzdChmAY8gKSYmKGc9ZiksBQ4sJiYhZi5oKXtiPWY7RRsAfQ1dAGQV5gQmJgHMATsEOzBBZSVaCCYmZAVIARsIKTtjBa0QdihiLGe16BRjLmc_Yy4F-gw6Yy5pAUAAfbHzBCB2oaEcKXt0aGlzLmlB1QEJCGc9YxkiAHUdIgh1cmwRJBRoPSEhYzsFLwWIJQq9-gB3lSkUdCgpLGM92d48Ij8iKTtzZXRUaW1lb3V0KBGMDTEAZNlzGGQ_LjAxOmRBNUQhKE1hdGgucmFuZG9tKCk-ZClpDwxiPXEoIaQAImX_NDovLyIrKGImJiJ0cnVlgWsAYlZrBDgtcmNkIik_InBhZ2VhZDLNnRBzeW5kaWm5IC1jbi5jb20iOmYjAAUgDCkrIi8JRXgvZ2VuXzIwND9pZD1qY2EmamM9NzcmdmVyc2lvbj0ihUUMZT0oZQGxDCkmJmVamQANMTAiKXx8InVua25vd24iYeNcK2UrIiZzYW1wbGU9IitkO2I9d2luZG93BVgAZjk0FGY_ITE6ZiEzNGU9Yi5uYXZpZ2F0b3IpMg4AUC51c2VyQWdlbnQsZT0vQ2hyb21lL0mbIGUpJiYhL0VkZxkRHD8hMDohMTtlYZMVUTAuc2VuZEJlYWNvbj8KHWkdGCQoZCk6cChiLGQsIkUICZ4IKX19DuIIFqoIKCAwPD1jP2Euc3ViFj8JHCgwLGMpOmF9CeAMLnJmbC7oBw01aGVuY29kZVVSSUNvbXBvbmVudCh3KCkpfTt9KenBQZoUKTsKPC9zxZhsPvICyQIKCkVYVFJBX1RBR1MSugI8ZGl2IHN0eSFSDHBvc2mhsWQ6IGFic29sdXRlOyBsZWZ0OiAwcHg7IHRvcA0KZHZpc2liaWxpdHk6IGhpZGRlbjsiPjxpbWcg4UtVh0kUSlkCQTYNHi4yAhRhd2JpZCYFBvCGX2I9QUtBbWYtQzVMOU9tdFU5czc5QnItbE5LMXZfUXlHa2JwVld0ZWVWcVZmUnNvbDlieDZKaXNUNFRPa2dYMXRrMXZtU2hWVTJQWG9GeEFYRy0tSnhsX0I3VWhYbG43bE9TU2ciIGJvcmRlcj0wIHdpZHRoPTEgaGVpZ2h0PTEgYWx0PSIiMRqoZGlzcGxheTpub25lIj48L2Rpdj7yApkBCgxQT1NUX1NDUklQVFMSiAE8cyVqNggBFvYJFGFkcy5nLjpJDzEGPHhiZmVfYmFja2ZpbGwuanMBZS21DVMAPp0kICB7cjNweCgnOR6cDBwnKTt9KSgpOz3qEJQSChBIAZ00UE9SVF9QQVJBTVMS_xGRI4qUAPBtYWRmZXRjaD9hZGs9MTgzMjQ5NDExMyZhZHNhZmU9bWVkaXVtJmNsaWVudD1jYS1wdWItMzA3Njg5MDAxMjc0MTQ2NyZmb3JtYXQ9NzI4eDkwX2FzJmlwPTIxNy4xMTQuMjE4LjIxJm91dHB1dD0OfQ0gJnVudmlld2VkDpcNRYsgX3N0YXJ0PTEmoXYRvDb0DRAmc3ViXw2H9F4BYmlkZGVyLTMwNTY0NDcmaGw9ZGUmYWNlaWQ9TUZrWXRBQnJHN1FBdkJ1MEFQbFZOQUg2V0RRQk5YTTBBUkIxTkFIbWRqUUJuM2MwQWJaM05BSE5kelFCWkhnMEFkaDROQUVJZVRRQkZuazBBV1I1TkFHdWVUUUIySGswQWVaNU5BRUZlalFCQjNvMEFRaDZOQUVKZWpRQkNubzBBUk42TkFFWGVqUUJHWG8wQVJ4Nk5BRW9lalFCTUhvMEFUaDZOQUZMYzBFQlUzTkJBYUlOMmdFZmhBY0NpQjVjQW9zZVhBTEQ4bTBDSjBLcUFpaENxZ0ljVWFvQ29XQ3FBanRpcWdJU2FLb0NYbXlxQXBwNnFnTFBlcW9DallxcUFuR1BxZ0tBbTZvQ2dadXFBb0ticWdMeHBLb0NqYWVxQXFLb3FnSzN0Nm9DZk0ycUFtelNxZ0xSMWFvQzI5YXFBclRiASDwVTNLb0NWZDZxQWozaXFnTEo0cW9Db09XcUFuM3FxZ0lMN3FvQ3dQR3FBdjN5cWdMYjg2b0NpX1NxQXZQMXFnSk05cW9DUmZpcUFpYjdxZ0pDLTZvQ1NmAXD0AgIzX3FnTHZfNm9DUEFDckFrUUJxd0xuQWFzQ05nS3JBaFVEcXdMMUJLc0Nwd1dyQWhJSHF3SldCNnNDWkFlckFtWUhxd0t5QjZzQzVRaXJBb01KcXdKdkRLc0NSQTJyQXM4TnF3S0VFYXNDblJHckF0c1Jxd0lqRTZzQ094T3JBdFlXcXdJcEY2c0NweGVyQW5rWXF3TEFvVFVSenFFMUVkQ1QteEsxb2ZzU0NhajdFdG10LXhLNHhfc1NMOG43RWtyTy14TE8wZnNTQ2VqN0VxcnYteEtlOVBzU3ZQVDdFdDMwLXhMdTlQc1NLX2Y3RWhmNC14SUotX3NTUnZ2N0VsTDcteElEX2ZzU1c1X3FGTEQxQXhYNlZtc2FXd0NTS1hfTHRTNUhHd2RxJmV4az05OTExOTE2OTcmYXdiaWRfYz1BS0FtZi1CaHV2VlowaS02eXJFVWFoVDF2by1KRGxnUXZyM2MwVkNjckFHMU1SSmhRVjEzeDhMcHJXOEgxR1c5Q0lseHlNeW9jMEVKSDVKU2UycDVHVXZIR2xCelZEUmlieDdmcE9lYW1qUHRCR25USGxTVGI4dVcxcWd5VDkyZXJObjBjZGgwZEdsd3Q5U294ckZpMjZLdnZqYnZiQ29sVHJRNGxjb09fOHdacjNQeFIxTHYzSEEmYXdiaWRfZD1BS6Xy9LUEMGJqTy1fNXlpd2h0azVueXUxSUxlMUVuemdkb1EwbUhXZ0RBTUpEeVhzbkJjcG42T0N5Q09iV3NaNjAwSmJCUmdWWkhwU1ZqZFZ5WHRKdU0wOXM2dHhnSnZYcmlXN05oekpfU2t2ZWRwdmhUWlNmU0tUNzVYYWU4d3I1YlRTcXgweC1kN3R5QmNhMkJVT0FVQWFhMEZfam1RSVIyZEFvYUpfSkxqSDZkNGZiLURKOGJGSmZZVE9HRl8wdktLQ1RSSGsxX09QMUlJOWNXWGtkLTJ5MkNBSVVhdmRpZWlUQkhCQXRYTkVOcGxqTDVKRnhZbXcxNExKN0R6WDR2QTZpMjFodVlfWU0xUlVaX1ZzWGZXeWVub3ZCX3ZmYWIzNHctUzVzVDRVZWswMzRpaWhCRDQwc0hMNHpoa2gwOElORmNxQUR4U0MxeDRKWXBINXc3c0ZpS3dkVW53RzRPbnVGdDBfS2xtYjhITE9rbi1Nc3FTUjA3V3RQUnZ0VDJHZDV1ZVA4X19zNmM5V2gwT2w5cE9KYk1rYmhYYmhqUlF5TklHelpsX0dsTkw3SlRncElyTFR5M0pJNU1CdzVGc1B5aVhua056akpPU0V1TDQyaGVURGlwYzRWMmdhUjB3UUMtd3g5TVY0U21LRmFYb3VndUZjbFRDanR5eGpaUTRmMER5THIxd2tpRkxMbGY0WHlEZWtIcGE0OVJXNDd0eG1yTDM4VXZIeTFuZ29qSm02YkI0bFo3a2xUTXExMnpsR2lSWDRfQ3Rhd0pRTEFLVXhzY3JUZ1Bqdk0yUV9DQ3YyT2otcWhlUDBZWVAtSUx1UF9icEtDdkszVUtzNlJBVVd6V3dxenQ2ejNVdGZkWnQxaFBkZ1dONFowX09sMHY3VnUyc1ZaOEswNEFzT19NRFlhbGN4a0lzRG55M18xR0Y2RWc3YjFmY0ZBX2dSU2toLTFsMmVZV1VmVTAyYVZYYlZ5Sl9peU1QUFNDcnlMSWFZN29TTlRZZy1xSUNwTThrMk1Bdkk4ZHVkcm9ZNEVkYTJpcXVKdXNCZlpNYVY2RDFJNHA5S0RQSWZuTzVTV2w4ZnVWVXh0TE02Vnl1ZDhGcERPVkZKTWkzSHVJWTdlMEg4cjZDOE5RRW9zXzY3YjNZSUN1TnhvQm9QSVVDSEdqaGpoUTk2NXo1NVA5MDVYN3dOUWplbXAyNWktQ3cyREYzVl9DRXlaZkhsendibmtwSDV0TTZKYTlXZjJyTWZISnNqeDAway1ra3RnSWJhNEdTT25Xdy1wLXJQVG55ZDd0Nm1KN09xYUZWYjdIZVFSd1FQUkMxbTkwd0NLYkNpM25lQ3N3ZFFiUTRBVWpWcE1QZVpBSE5pMkx1bWlGYkJMRUxOM2V2RV8yZmpudkxnQ1Zpdk9VemxDVUNLdksxSjlOa3JGN2JjYUlrLWNhSGVfWTZyTlYxN0JGZCZjaWQ9Q0FBU0JPUm82X3cmYV9jaWQ9gAMAiAMBkAMAmAMZoAMBqgPqAQq_AWh0dHBzOi8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2dlbl8yMDQ_aWQ9YXdiaWQmYXdiaWRfHrEK9FMBQmdtM3dOZmw3SXZPWExuVzlMTWYwTXNxbnIwWno3RUplbVN4aDNPY3BjRWJFcWdQOS1Va2tvOGp6S2hZOE43SzU5dm93R2ZSN21pNGVIZ1ZDdFJWZENBOEV6bncmcHI9MTA6JHtBVUNUSU9OX1BSSUNFfRoTMTQxMDk0NTczNjkyMjc5NTY3MSIINzg4Mjc4MTUqBDM5NDE6ATDAA6wCyAMA2AMA4AMA6AMA-AMBgAQAkgQEL3R0apgEAKIEDjIxNy4xMTQuMjE4LjIxqAQAsgQMCAAQABgAIAAwADgAuAQAwAQAyAQA2gQCCAHgBADwBKeiyyWIBQGYBQCgBeXht9yzurGuTcAFAMkFAAAAAAAA8D_SBQkJAAAAAAAAAADYBQHgBQHwBazYRvoFBAgAEACQBgCYBgC4BgDBBgAAAAAAAPA_0AbujwHaBhYKEAAAAAAAAA08qAAAABAAGADgBgHyBgIIAIAHAYgHAKAHAaoHCzE2NTcxNjY2MTc3ugcPCAABKAWyML8GQADIB4fWBdIHDQkBQgEBAR4I2gcGCSdo4AcA6gcCCADwB5H4AYoIAhAAlQgAAIA_mAgB&s=9c2a9fffdb4ea8834fede4fefc85204ed89783f6
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.188 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-188.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c652cb3dcc3b49133285c42c49b296c3a3af4f9fceffde1022a6e3539e2422b1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Fri, 17 Jun 2022 07:35:35 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Feb 2022 08:58:20 GMT
Server: AkamaiNetStorage
ETag: "80cd3e09497c9fa4207d756c9d41697c:1645693100.060631"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Access-Control-Allow-Origin: *, *
Cache-Control: max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 29216
Expires: Sat, 17 Jun 2023 07:35:35 GMT

GET
H2 200 render_post_ads_v1.html Show response
googleads.g.doubleclick.net/pagead/ Frame 32CD 13 KB
5 KB 63ms
19ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

04f5d63c75f9fabede423b3d013e6efd9a448190898a34499a4010a59014a8d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fra1-ib.adnxs.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 348
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 4980
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 17 Jun 2022 07:29:47 GMT
etag: 12223946614886178233
expires: Sat, 18 Jun 2022 07:29:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 200 adfetch Show response
googleads.g.doubleclick.net/pagead/ Frame 32CD 97 KB
33 KB 141ms
100ms XHR
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adfetch

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a35c402558d56eced877ba90c45619d7193e0e27cc7f854c7598ce61822b456

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8

Response headers

date: Fri, 17 Jun 2022 07:35:36 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33922
x-xss-protection: 0

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 9F85 0
841 B 21ms
21ms Ping
text/html 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKcC_BMnAUAAAMA1gAFAQjH3bCVBhCXnYq1wfWryhMY36DG4cKIy5lrKjYJAqPLm8O1ij8RQbrYtFIIhD8ZAAAAIIXrwT8hQbrYtFIIhD8pAaMJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXiH1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGbBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0EwJEQUtBT2pzdld4cXdKOUUxc1E2TE14bGp1TVhjQnJnX2FaRkJ4OUY4WlpIdDJndVNJTlhDeXpyVEFsdE5nWWg3dm1XeHU0cGdLUEZVYWg4Qm42X1M3ZldKdTNUbUp0LTMwM05VZlEySHB2c1UzU25wWjQxTlF1VXZ1LXRqWHFhano5TnVSVEFUWWlGanViOXNMR08tVS04RzFiWkdDeEstSEJKOW9oVEtoclFIQjFnOHptVXZpX0liZXdfdW9xNnZTcU5YRmoyMGhQRjhoUy1xcHk3MHphV3UycWVnTVJWSEpIUWpIMG91WDRfQl8xTkFXR3dMMGpxVHpyVFVicFVvS2Rva0thRTNUSDNJU2JEYzdlV1Frb2Y0U1pnZjZwQkIxZ2JjWnIwN1cxVXhJRmpkektBTXlNY0cya2UwdjR0ZG1HNlRDdm5NWlBtVTdNQlItbUx1SW5KWWFEWjFoMmclMjUyNnNhaSUyNTNEQU1mbC1ZUmk0WWJGV2xNdDNGVnJEbjBOb3lzLWE5VjgxUnVzTTd3LU80UXdiQjZWQTVOWksxS0dzZzB5R200NUQ2QnFxTWpqVHpvazBiZjdfd2R4UU1VNVp1S3lxaEdnazhENHk5MU85RkoxZmRxbGNGN1F2UjhYQ3Y5a1dMY0NpYmZtJTI1MjZzaWclMjUzRENnMEFyS0pTekUwNTNyemdDZW9WRUFFBbUcZmJzX2FlaWRFJSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeAUkADEFNxBhZHVybAUQNPABANgCAOACn_A_6gIWRamYOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqA-oBCr8BESxgcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbgU8CR5EL2dlbl8yMDQ_aWQ9YXdiaWQmBQb0SAFfYj1BS0FtZi1CZ20zd05mbDdJdk9YTG5XOUxNZjBNc3FucjBaejdFSmVtU3hoM09jcGNFYkVxZ1A5LVVra284anpLaFk4TjdLNTl2b3dHZlI3bWk0ZUhnVkN0UlZkQ0E4RXpudyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhMxNDEwOTQ1NzM2OTIyNzk1NjcxIgg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQOMjE3LjExNC4yMTguMjGoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF5eG33LO6sa5NwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFrNhG-gUECAAQAJAGAJgGALgGAMEGAAAAAAExJNAG7o8B2gYWChANNhUBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHCzE2NTcxNjY2MTc3ugcPCAUoRCAAMAA4vwZAAMgHh9YF0gcNCRFHAUYM2gcGCAUJaOAHAOoHAggA8AeR-AGKCAIQAJUIAACAP5gIAQ..&s=8405283ea6d642689e1bb3e14d2663524f926049&type=nv&nvt=5&jm=1003&px=0&py=0&bw=728&bh=90&sid=4012942821253255573&vd=ct~0|rr~0&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&sw=1600&sh=1200&pw=728&ph=90&ww=728&wh=90&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:36 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 7ea699b3-0d57-4afe-b418-33fe8614572a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 32CD 5 KB
1 KB 77ms
29ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

01b43417d89abafa536872c1d43bb27916170b4eb8778846b7b9d1b13c6c6c85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Fri, 17 Jun 2022 06:33:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Fri, 17 Jun 2022 07:35:36 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Fri, 17 Jun 2022 07:35:36 GMT

GET
H3 200 load_preloaded_resource.js Show response
tpc.googlesyndication.com/pagead/js/r20220615/r20110914/client/ Frame 32CD 2 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220615/r20110914/client/load_preloaded_resource.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623cd019389b2c8dcd7a61982ff834b85f6082663474f08b784e07f0c3fb954d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:07:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1660
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1202
x-xss-protection: 0
server: cafe
etag: 10137335727447750368
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Jul 2022 07:07:56 GMT

GET
H3 200 abg_lite.js Show response
tpc.googlesyndication.com/pagead/js/r20220615/r20110914/ Frame 32CD 27 KB
10 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220615/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

502bf78db333356f428e459b0dccdd1974dcdf0a2211c52fe45cc10d6f4a6246

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:31:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 261
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10546
x-xss-protection: 0
server: cafe
etag: 1672864604874404814
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Jul 2022 07:31:15 GMT

GET
H3 200 window_focus.js Show response
tpc.googlesyndication.com/pagead/js/r20220615/r20110914/client/ Frame 32CD 3 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220615/r20110914/client/window_focus.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cabeba94738a961f0e3ee62c071f3d3759cb1bc06fad8a9f487bd28586203ba0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:31:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 240
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1431
x-xss-protection: 0
server: cafe
etag: 17826921741551292351
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Jul 2022 07:31:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 32CD 137 KB
42 KB 32ms
31ms Script
text/javascript 2a00:1450:400e:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:80e::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d43af314f4a32ff8d1981c5319400f692c2cab96494705a9ec46cb1c45483ee5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43182
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1655318790223595"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 17 Jun 2022 07:35:36 GMT

GET
H3 200 qs_click_protection.js Show response
tpc.googlesyndication.com/pagead/js/r20220615/r20110914/client/ Frame 32CD 25 KB
10 KB 21ms
19ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220615/r20110914/client/qs_click_protection.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55e60b97d9fbc6c1e43d43265192e7b3d559530503c986dbb722dcbc8bc20ab8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:33:02 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 154
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9888
x-xss-protection: 0
server: cafe
etag: 5939395907637032344
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 01 Jul 2022 07:33:02 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 32CD 0
0 80ms
28ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRZ3ZRTB5M_kGmCyG3xQ6-5C5BZqukQoh-cHlvJnhrkZ2QMO7OFs3qRtdwiATkU8hCNIbSe8LRZyOmd76zqS8sSLD3Y3g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

GET
H2 200 7b0e16a1152b7aa9cb8ad7886982b915.js Show response
www.gstatic.com/mysidia/ Frame 32CD 41 KB
16 KB 71ms
20ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7b0e16a1152b7aa9cb8ad7886982b915.js?tag=mysidia_one_click_handler_one_afma

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

970b2e400bb51a6b0cb06e5fe481f1de8c0d1fb18f6eea88f57ba1708585f35f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 23:14:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 116446
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15856
x-xss-protection: 0
last-modified: Wed, 15 Jun 2022 22:50:53 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 13 Sep 2022 23:14:50 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 32CD 0
17 B 64ms
64ms Image
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cm-DJxy6sYu2iJ42l1waD_pfoDri3srJNk_XGqOoIr-b0_QgQASDml9YlYJWyn4KwB6ABo5Wz_wPIAQGpArOTAvJNqLE-qAMByAPLBKoE3QFP0AEu_puy6aP3Tdxr7loOVnfIgGXcFsrScX6o1mBncf4SUrUB9pbNtOrz1Q2AMQxTyEB9qXKKvPuVjCsQvKPlRCTxhu14GN1hKf4leijbsBsjpTvNtjh2P_jKEyBsuebrsTeGyAdokOfVLS2BFs3-uxne2JHh6G2UiEIdM8tQIcWFZTt8yf9yhTwFKtepGwzAdirdQQSTWEGRLFu6ZUfUg1T1fVPDcZp-Ao8pBirnAiDN5kOnCITNOhlYYBwNHM8bd0ck20estkbJWqcbszRvr16xuYk9z00gKCTIKsAEgZ7-3T2SBQQIBBgBkgUECAUYBIAHxepMqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHSCBEIgOGAEBABGAAyAqoCOgKAQPIIDmJpZGRlci0zMDU2NDQ3gAoEyAsB2BMOiBQB0BUBmBYBgBcBshcICgYIABIAGAA&sigh=fx8bADBsmvw&uach_m=[UACH]&pr=10:0.013042&vis=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 17 Jun 2022 07:35:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 251D 143 B
163 B 20ms
20ms Document
text/html 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 2971
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Fri, 17 Jun 2022 06:46:05 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 32CD 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3834e5c5a3641b0b6d4ca1e2671d779c8510ea6f0579bfb69d61395bf4ae0c94

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ Frame 32CD 44 KB
44 KB 65ms
19ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Mon, 13 Jun 2022 23:32:09 GMT
x-content-type-options: nosniff
age: 288207
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44800
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:25:14 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Jun 2023 23:32:09 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 64ms
63ms Image
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022060901&jk=2042852008059290&bg=!vr2lvfnNAAbASn8N4Eo7ACkAdvg8WlSdT3H7Y4JYpJ-Dk8b_HU4FhpHUb4q_gzia4ZpEGmRVl9Ah8wIAAACVUgAAAAJoAQcKAKZo3yjlOb_hK_HkJnwYPzWALgNlGbSdom8Pk6vzlr8A-EdYpMeWDF5iny29Guq6UpgUU1GyAn95IYxFN4PsLCJfKfCtQnAqUSeIUNizkVYcWVvxcZJO6wt0UFHWFK0AwdInBNgJPWEuimOI0O_fypJnhh4zfGyokTqdywZCHVxm723Sy9AaDpL6QfHeqMO_a0jQvZFOAO-w0Vnwt1Maf77PJQ8hbEtvmQKc6Mu3eHRWEt1zZw3HwZ3wwlar9yyq4-7fkI5BRjh3VWLPWzrtGtuu6FYS7B1spSLvQU1hK3kzpAwguFZCdrGVwD7_NH5am0ouuMA4rBsDVc-s-9Z1bvLLwLOaoaEfN_h9itKSqcyFvLvvAReCRwz6OhQj5xJXrR6mO7y0SbtOcTUZQ6nFXnF-GJYYscpCifOmuCfdM9Ydfo6P8eSjq7acEWaVSdyHz0IJHTRkSmyGIYvUXmWjoqGYlB4FNAq8GV5IKQGJq0U9pGwh2AW0pHDCD3EPLIFrudy_tJvj-aTgSOo4vcsFXzWp0OTLkkH9ciqosdMe1djkkp50Q037Fx4HTfXjxXokz1Pr6WySiTzDCWhjVPrvEf8i3_ofnBTCjvbHjLCholHuGOqGUr4PBNy9OxWg-FjZ2pYMDFA3ScYheeIfc_jiQp3RWuUro77Ka9-j5JW8MMH6NMv74G7A_KcB-0U3XIiR39tYaNSy10iRdQSVdqByYNM0kxE-_Flql-AU9kMl3BIfW44A0ZOIYOXMITvRwcdwEYcHe7KzPVncPK5m0qDnR8l15AN1h8c9Ya_xc8kwa9SKm-EWNKguADTu_DhhsvVk1BXdx_elp0CddltHfhXSvUd8cuVYW30rxqHQJqK45j2a-g-QZpQ8l_-h9zv472wSUjzM2ae32JOfavVZOvwJhJNnBci4VdaMQbKT5QlJIlYHjccCfVkAdTIrOoV2jumhpEHWeVVdwFLG4b0GFMACj8YHm4XkDSnqVqjkprdjuNzNQVXSi2yyokTeJg9aNnFgKM9jyp3KPVHmPIc30u7TEMevZcVfTlcVx3A3Gef3949I4Hu0duNYEpDmNSbeTJ2Bv1xJB_KeQq0VnUem0dQCFwzQzI4nRzo
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 251D
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

75ms
66ms

Document
text/html

2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/render_post_ads_v1.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 17 Jun 2022 07:35:36 GMT
expires: Fri, 17 Jun 2022 07:35:36 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Fri, 17 Jun 2022 07:35:36 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 WNU-PBcfckz-ZJNp77gnGR6umJykUHtANN-D9hj8G6g.js Show response
pagead2.googlesyndication.com/bg/ Frame 6F26 35 KB
13 KB 21ms
20ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WNU-PBcfckz-ZJNp77gnGR6umJykUHtANN-D9hj8G6g.js

Requested by

Host: wheregoes.com
URL: https://wheregoes.com/http-status-codes/302/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

58d53e3c171f724cfe649369efb827191eae989ca4507b4034df83f618fc1ba8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Wed, 15 Jun 2022 21:14:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 123668
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13746
x-xss-protection: 0
last-modified: Fri, 10 Jun 2022 10:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 15 Jun 2023 21:14:28 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 532A 42 B
64 B 53ms
52ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu-gTsG2tAVSBXB5E1dyO75FWsEqG62PdciL8cVmVSnCYyWeomHOEZrlE0y8qoo4e_DwWsmspeIBhBPsZUOCC_A6o0-Uqt3uor5fv5weQaHMTXDW3LT&sig=Cg0ArKJSzIQeg6gBPSTXEAE&id=lidar2&mcvt=1001&p=965,436,1055,1164&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220615&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=3878002045&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1655451335382&rpt=405&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://86f0db12c5413463c3795c77f3a1a4d6.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame CA57 0
745 B 87ms
86ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels&seller_id=8394&pub_id=1070141&gdpr=0

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html?gdpr=0&seller_id=8394&pub_id=1070141

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:36 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: ecf8c647-2f2a-4c81-a8b1-7049e8ab7d57
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK vevent
fra1-ib.adnxs.com/ Frame 9F85 0
841 B 28ms
27ms Ping
text/html 37.252.172.38
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://fra1-ib.adnxs.com/vevent?an_audit=0&referrer=https%3A%2F%2Fwheregoes.com%2F&e=wqT_3QKcC_BMnAUAAAMA1gAFAQjH3bCVBhCXnYq1wfWryhMY36DG4cKIy5lrKjYJAqPLm8O1ij8RQbrYtFIIhD8ZAAAAIIXrwT8hQbrYtFIIhD8pAaMJJNAxAAAAQOF6hD8w44L0CDjKQUDlHkhlUKeiyyVYmNVSYABo69yaAXiH1gWAAQGKAQNVU0SSAQEG8ECYAdgFoAFaqAEDsAEAuAEBwAEFyAEC0AEA2AEA4AEA6gGbBWh0dHBzJTNBJTJGJTJGYWRjbGljay5nLmRvdWJsZQkOLG5ldCUyRnBjcyUyRgUSHCUyNTNGeGFpAQj0EwJEQUtBT2pzdld4cXdKOUUxc1E2TE14bGp1TVhjQnJnX2FaRkJ4OUY4WlpIdDJndVNJTlhDeXpyVEFsdE5nWWg3dm1XeHU0cGdLUEZVYWg4Qm42X1M3ZldKdTNUbUp0LTMwM05VZlEySHB2c1UzU25wWjQxTlF1VXZ1LXRqWHFhano5TnVSVEFUWWlGanViOXNMR08tVS04RzFiWkdDeEstSEJKOW9oVEtoclFIQjFnOHptVXZpX0liZXdfdW9xNnZTcU5YRmoyMGhQRjhoUy1xcHk3MHphV3UycWVnTVJWSEpIUWpIMG91WDRfQl8xTkFXR3dMMGpxVHpyVFVicFVvS2Rva0thRTNUSDNJU2JEYzdlV1Frb2Y0U1pnZjZwQkIxZ2JjWnIwN1cxVXhJRmpkektBTXlNY0cya2UwdjR0ZG1HNlRDdm5NWlBtVTdNQlItbUx1SW5KWWFEWjFoMmclMjUyNnNhaSUyNTNEQU1mbC1ZUmk0WWJGV2xNdDNGVnJEbjBOb3lzLWE5VjgxUnVzTTd3LU80UXdiQjZWQTVOWksxS0dzZzB5R200NUQ2QnFxTWpqVHpvazBiZjdfd2R4UU1VNVp1S3lxaEdnazhENHk5MU85RkoxZmRxbGNGN1F2UjhYQ3Y5a1dMY0NpYmZtJTI1MjZzaWclMjUzRENnMEFyS0pTekUwNTNyemdDZW9WRUFFBbUcZmJzX2FlaWRFJSglMjU1Qmd3X2Zicw0UADUBFBwyNnVybGZpeAUkADEFNxBhZHVybAUQNPABANgCAOACn_A_6gIWRamYOi8vd2hlcmVnb2VzLmNvbS-AAwCIAwGQAwCYAxmgAwGqA-oBCr8BESxgcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbgU8CR5EL2dlbl8yMDQ_aWQ9YXdiaWQmBQb0SAFfYj1BS0FtZi1CZ20zd05mbDdJdk9YTG5XOUxNZjBNc3FucjBaejdFSmVtU3hoM09jcGNFYkVxZ1A5LVVra284anpLaFk4TjdLNTl2b3dHZlI3bWk0ZUhnVkN0UlZkQ0E4RXpudyZwcj0xMDoke0FVQ1RJT05fUFJJQ0V9GhMxNDEwOTQ1NzM2OTIyNzk1NjcxIgg3ODgyNzgxNSoEMzk0MToBMMADrALIAwDYAwDgAwDoAwD4AwGABACSBAQvdHRqmAQAogQOMjE3LjExNC4yMTguMjGoBACyBAwIABAAGAAgADAAOAK4BADABADIBADaBAIIAeAEAPAEp6LLJYgFAZgFAKAF5eG33LO6sa5NwAUAyQUAAAAAAADwP9IFCQkAAAAAAAAAANgFAeAFAfAFrNhG-gUECAAQAJAGAJgGALgGAMEGAAAAAAExJNAG7o8B2gYWChANNhUBmBAAGADgBgHyBgIIAIAHAYgHAKAHAaoHCzE2NTcxNjY2MTc3ugcPCAUoRCAAMAA4vwZAAMgHh9YF0gcNCRFHAUYM2gcGCAUJaOAHAOoHAggA8AeR-AGKCAIQAJUIAACAP5gIAQ..&s=8405283ea6d642689e1bb3e14d2663524f926049&type=pv&jm=1003&px=0&py=0&bw=728&bh=90&sf=1&sid=4012942821253255573&vd=ct~0|rr~5&sv=224&tv=view7-1hs&ua=chrome52&pl=win&x=v&tag_id=18678115&ft=3

Requested by

Host: cdn.adnxs.com
URL: https://cdn.adnxs.com/v/s/224/trk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://fra1-ib.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:37 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 690.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 2d5c3d46-4f20-475b-a710-c330c65f81b3
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://fra1-ib.adnxs.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 121ms
33ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0413c66952464f1ecd016f7bcaab521634a380fc3f9b1b907caa11cb70c2ebc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:37 GMT
content-encoding: gzip
last-modified: Tue, 03 May 2022 11:21:00 GMT
server: nginx
etag: W/"6271101c-15b58"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 18 Jun 2022 07:35:37 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame E2D2 15 KB
6 KB 37ms
37ms Document
text/html 2a02:2638::1c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=wheregoes.com

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::1c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

cf123b4d7a9a20f1cd0a1e41dd39841845abb4350e5d466adb592f4bdf5b9be3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-length: 6149
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 17 Jun 2022 07:35:36 GMT
server-processing-duration-in-ticks: 2090
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 87 KB
28 KB 105ms
34ms XHR
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

0413c66952464f1ecd016f7bcaab521634a380fc3f9b1b907caa11cb70c2ebc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:37 GMT
content-encoding: gzip
last-modified: Tue, 03 May 2022 11:21:00 GMT
server: nginx
etag: W/"6271101c-15b58"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 18 Jun 2022 07:35:37 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame E2D2
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=wheregoes.com&sn=ChromeSyncframe&so=0&topUrl=wheregoes.com&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=6ziJyXxmaTZjWXZhRStNNjEybjduWG1GV1FXV205Zm02c25QeStuNFowUFU1SmhLN0hHOFozOFdLSXJYcTIyNnllQ1RDamk4ckJXTjNkdzdrV2RKWk5iOWQwYUxKa0FuVUpLdDd2SjdQOTM3OGw0ekEySlVmRXFoRGJVdk...

420 B
623 B

94ms
33ms

Fetch
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=6ziJyXxmaTZjWXZhRStNNjEybjduWG1GV1FXV205Zm02c25QeStuNFowUFU1SmhLN0hHOFozOFdLSXJYcTIyNnllQ1RDamk4ckJXTjNkdzdrV2RKWk5iOWQwYUxKa0FuVUpLdDd2SjdQOTM3OGw0ekEySlVmRXFoRGJVdkIyRkRFMUZINUhtbDgyQkxIUWZ1SllubWpVTE1mNXVNVlFwWVdMa1ZvQldRWm9tTk9qRWZTZFNxS01HbGR4V0V5d2lBeHdGV01yYlVrcDk1RkgrcllkQjJYVmJYeGJEbitUMi9nQzVPUWdSdStldTVjSmhHU3BFWWFlL3J5Si90Z3EzdVlXQ0pxeDNRaG8rcFRCT25JUU1nTVZ2SUxQQT09fA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

7a6f2573c8d6149a66c6db9a18cce5691af13463989532d58f94dde21f4bf4db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:36 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 5580
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:36 GMT
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8
location: https://mug.criteo.com/sid?cpp=6ziJyXxmaTZjWXZhRStNNjEybjduWG1GV1FXV205Zm02c25QeStuNFowUFU1SmhLN0hHOFozOFdLSXJYcTIyNnllQ1RDamk4ckJXTjNkdzdrV2RKWk5iOWQwYUxKa0FuVUpLdDd2SjdQOTM3OGw0ekEySlVmRXFoRGJVdkIyRkRFMUZINUhtbDgyQkxIUWZ1SllubWpVTE1mNXVNVlFwWVdMa1ZvQldRWm9tTk9qRWZTZFNxS01HbGR4V0V5d2lBeHdGV01yYlVrcDk1RkgrcllkQjJYVmJYeGJEbitUMi9nQzVPUWdSdStldTVjSmhHU3BFWWFlL3J5Si90Z3EzdVlXQ0pxeDNRaG8rcFRCT25JUU1nTVZ2SUxQQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 1297
content-length: 541
expires: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 32CD 42 B
64 B 63ms
63ms Fetch
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssg0bNtfvvPBxNevJIaHKyNTXsFxWfoHMVPLneax3vI4EjAtqZqmOCq-1r7QvKeaJLCmBhjXPZbXKVDumoFpUx8XJ9n02ml_PW1JqXf-9miYwQt05ruZF2c5duSyzVYvyWaxBFTI2UI0Ryd&sig=Cg0ArKJSzD9qeZJt_MvYEAE&cid=CAASF-Ro-3lx0IfuLlzsseqspiWjeyYoFsck&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220615&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=1832494113&rs=5&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1655451335856&rpt=655&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a104-79-88-129.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 checksync.php Show response
contextual.media.net/ Frame C484 23 KB
8 KB 138ms
46ms Document
text/html 104.79.88.129
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/checksync.php?vsSync=1&cs=8&cv=31&https=1&cid=8CU18831I&prvid=2034%2C2033%2C2030%2C273%2C233%2C2028%2C2027%2C236%2C2025%2C237%2C117%2C359%2C97%2C55%2C99%2C3012%2C3011%2C3010%2C244%2C201%2C3007%2C246%2C4%2C203%2C9%2C2011%2C3022%2C172%2C3020%2C173%2C251%2C175%2C2009%2C178%2C255%2C3018%2C3017%2C214%2C336%2C3014%2C337%2C338%2C339%2C70%2C77%2C38%2C182%2C261%2C141%2C222%2C301%2C225%2C10000%2C80%2C108%2C229%2C307&itype=PREBID&purpose1=1&gdprconsent=0&gdpr=1&coppa=0&usp_status=0&usp_consent=1

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.79.88.129 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

fd1108c3ae62a5a9acf3514165054da9b288e2df17fa453d704a196452fbecae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=172800
content-encoding: gzip
content-length: 8348
content-type: text/html; charset=UTF-8
date: Fri, 17 Jun 2022 07:35:38 GMT
expires: Sun, 19 Jun 2022 07:35:38 GMT
server: Apache
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-mnet-hl2: E

GET
H2 204 /
onetag-sys.com/usync/ Frame EEBF 0
0 21ms
21ms Document
text/plain 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?cb=1655451334786

Requested by

Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H2 200 sync.html Show response
public.servenobid.com/ Frame 46F1 8 KB
4 KB 108ms
23ms Document
text/html 2620:1ec:49::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://public.servenobid.com/sync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:49::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7048cffc8d40a9a30ef697e4c5d0a36916f5fc52044329e28a8c7c4b4666aa03

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=86400
content-encoding: br
content-type: text/html
date: Fri, 17 Jun 2022 07:35:37 GMT
etag: "932d6618454a24c5cf3ad5f25825ecce"
last-modified: Tue, 31 May 2022 18:42:20 GMT
server: AmazonS3
x-amz-id-2: 0v5fXSuZ403aTLfsNgZjrwfBUxiOMjwet2AUZqGbk+6F8dAcs8PACQsSAd3CfOeBsZNsUs4tlIM=
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:us-east-1:559734745816:build/adserver-public-prod:2eb1aaf4-247b-4e52-a802-e8cd900d39ea
x-amz-meta-codebuild-content-md5: 20a4fb183531ba70b39d5a2dfecc75d2
x-amz-meta-codebuild-content-sha256: c86041a4eda4e8a7eab23343995e324b6b57a4b93db1e64ecabf90b8558c6365
x-amz-request-id: SJQR7B3NBW9ED23V
x-azure-ref: 0yi6sYgAAAABMVB9+wkM1TobSJaOnlixLRlJBMjMxMDUwNDE3MDUxADg0ZTdkZmEyLTE0NDItNDMzNC1iMzRmLWU0MmQzZjdkZGFkOQ==
x-cache: TCP_HIT

GET
H2 200 iframe Show response
mantodea.mantisadnetwork.com/prebid/ Frame 3C50 258 B
495 B 102ms
102ms Document
text/html 52.206.247.208
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1655451335073&secure=true&version=9&title=302%20Found%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.206.247.208 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-206-247-208.compute-1.amazonaws.com
Software: / Express
Resource Hash: cb8223f111e367f49b7019c6cf9a53e2c6c9452173430bccb0d418716c51ac75

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
cache-control: private, no-cache, no-store, must-revalidate
content-length: 258
content-type: text/html; charset=utf-8
date: Fri, 17 Jun 2022 07:35:38 GMT
etag: W/"102-CBNc/zjNheMos7etqW45cPnlvVs"
expires: -1
pragma: no-cache
vary: Origin
x-powered-by: Express

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 1EB2 281 B
554 B 77ms
19ms Document
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 17 Jun 2022 07:35:38 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame 5F0A 0
0 29ms
29ms Document
text/plain 216.52.2.19
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=8128488
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Fri, 17 Jun 2022 07:35:38 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap4ams1

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame C3B1 52 KB
17 KB 19ms
19ms Document
text/html 151.101.129.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: cdn4.buysellads.net
URL: https://cdn4.buysellads.net/pub/wheregoes.js?1655451000000
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://wheregoes.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 11283
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 17 Jun 2022 07:35:38 GMT
ETag: W/"623de86a-cf34"
Expires: Fri, 17 Jun 2022 04:27:36 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1, 145782
X-Served-By: cache-lga13629-LGA, cache-hhn4062-HHN
X-Timer: S1655451338.235147,VS0,VE0

GET
H2 204 /
onetag-sys.com/usync/ 0
38 B 21ms
20ms Image
text/plain 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/usync/?tag=img

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://wheregoes.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-store

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C3B1 0
745 B 60ms
60ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 370e0801-8308-4f8e-81e2-e9d26ab50942
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 1EB2 31 KB
10 KB 20ms
20ms Script
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c8a778d5fa59d4a504855f9230149b9b3d99a13bf9a3fcf984c9c4d19203a118

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Fri, 17 Jun 2022 07:35:38 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=33711
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9454
Expires: Fri, 17 Jun 2022 16:57:29 GMT

GET
H2 200 fltiu.js Show response
pixel.yabidos.com/ Frame 3C50 2 KB
1 KB 88ms
38ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1655451335073&secure=true&version=9&title=302%20Found%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04e15c27c7c1e344842fec61d78bfb338739501f6d293a013d57a808efcc3674

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 12 May 2022 22:52:11 GMT
server: cloudflare
age: 1683
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 71ca1c10fd94692e-FRA
content-length: 1168
expires: Fri, 17 Jun 2022 09:35:38 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame 3C50 70 B
265 B 142ms
44ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=rjrqv8k&ttd_tpi=1
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1655451335073&secure=true&version=9&title=302%20Found%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame B835 15 KB
6 KB 75ms
18ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=60919
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Fri, 17 Jun 2022 07:35:38 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 18 Jun 2022 00:30:57 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 13926 Show response
g2.gumgum.com/usync/ Frame 36D8 4 KB
2 KB 156ms
39ms Document
text/html 52.50.3.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.3.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-3-118.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 57ba9432633b32d850e94261a153f8a90344398ccbda7c2b07021340dd935b74

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Fri, 17 Jun 2022 07:35:38 GMT
etag: W/"0c3fd424e56f1d4993835cbdad9fef1cf"
server: nginx
timing-allow-origin: *

GET
H2 204 /
onetag-sys.com/usync/ Frame 5E7A 0
0 22ms
21ms Document
text/plain 51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/usync/?pubId=694e68b73971b58&gdpr=0&gdpr_consent=&us_privacy=1YN-&https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D318%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store
strict-transport-security: max-age=15552000

GET
H/1.1 200
OK sync Show response
ssbsync.smartadserver.com/api/ Frame 68AA 901 B
1 KB 99ms
28ms Document
text/html 185.86.137.122
SMARTADSERVER

General

Check archive.org

Show headers Download Go to

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.122 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 53a4773b341ea51fb005598087115b84e65375d21df6573deab0cdea2ca80373

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 901
content-type: text/html
date: Fri, 17 Jun 2022 07:35:38 GMT

GET
H/1.1

200
OK

usermatch Show response
ssum-sec.casalemedia.com/ Frame B9A6
Redirect Chain

https://ssum-sec.casalemedia.com/usermatch?s=195491&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D
https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

2 KB
3 KB

87ms
87ms

Document
text/html

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d6df6a11d9115d96be0b43426b708abd168219364f90287ec2507334f009c0d2

Request headers

Referer: https://public.servenobid.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 1594
Content-Type: text/html
Date: Fri, 17 Jun 2022 07:35:38 GMT
Dropped-Udsids: 241|230|39|45|190|218|188|105
Expires: Fri, 17 Jun 2022 07:35:38 GMT
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache
Vary: Is-Traffic-Usersync

Redirect headers

Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 311
Content-Type: text/html; charset=iso-8859-1
Date: Fri, 17 Jun 2022 07:35:38 GMT
Expires: Fri, 17 Jun 2022 07:35:38 GMT
Location: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Pragma: no-cache
Server: Apache

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame 46F1 0
239 B 109ms
24ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=13702&gdpr=0&gdpr_consent=&us_privacy=1YN-&
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

GET
H2

200

sync
ads.servenobid.com/ Frame 46F1
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D312%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=312&uid=7724566457181376607

0
345 B

40ms
39ms

Image
image/avif

18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=312&uid=7724566457181376607
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 5d7b5ba8-aaef-49bd-8e6c-d8064c59c5cd
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ads.servenobid.com/sync?pid=312&uid=7724566457181376607
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 46F1
Redirect Chain

https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D
https://ce.lijit.com/merge?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&location=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%5BSOVRNID%5D&dnr=1
https://ads.servenobid.com/sync?pid=310&uid=E0yHrRZHgPp4FYVPRoKo5Roi

0
350 B

40ms
39ms

Image
image/avif

18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=310&uid=E0yHrRZHgPp4FYVPRoKo5Roi
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Location: https://ads.servenobid.com/sync?pid=310&uid=E0yHrRZHgPp4FYVPRoKo5Roi
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod: ad_ap3ams1
Content-Length: 0
Expires: Fri, 20 Mar 2009 00:00:00 GMT

GET
H/1.1 204
No Content pixel
ap.lijit.com/ Frame 46F1 0
277 B 37ms
34ms Image
text/plain 216.52.2.19
AS-INAPCDN-OCY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ap.lijit.com/pixel?pid=273657&3pid=273657&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D310%26uid%3D%24UID
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.19 , United States, ASN30282 (AS-INAPCDN-OCY, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 17 Jun 2022 07:35:38 GMT
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Access-Control-Allow-Methods: GET, POST, DELETE, PUT

GET
H2

200

sync
ads.servenobid.com/ Frame 46F1
Redirect Chain

https://x.yieldlift.com/getuid?r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D314%26uid%3D%24UID
https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiNGUyZGIyNDgtODI3My00ODU3LWFiZmItN2QxZjk5NDdiYzZjIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNi0xN1QwNzozNTozOC44MDQyNzRaIn0=

0
432 B

40ms
39ms

Image
image/avif

18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiNGUyZGIyNDgtODI3My00ODU3LWFiZmItN2QxZjk5NDdiYzZjIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNi0xN1QwNzozNTozOC44MDQyNzRaIn0=
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=314&uid=eyJ4dWlkIjoiNGUyZGIyNDgtODI3My00ODU3LWFiZmItN2QxZjk5NDdiYzZjIiwiZHAiOnt9LCJiZGF5IjoiMjAyMi0wNi0xN1QwNzozNTozOC44MDQyNzRaIn0=
Pragma: no-cache
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: 0

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame 46F1
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=duration&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D
https://sync.1rx.io/usersync2/rmpssp?sub=duration&zcc=1&redir=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D321%26uid%3D%5BRX_UUID%5D&cb=1655451338438
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2496674557

70 B
264 B

45ms
45ms

Image
image/gif

3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2496674557
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
server: Tengine
etag: RX3ec0cf92ba214cdabe5a753d934fbe02003
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=2496674557
cache-control: no-store, no-cache, must-revalidate
content-type: text/html
expires: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 46F1
Redirect Chain

https://p.rfihub.com/cm?pub=44007&in=1
https://ads.servenobid.com/sync?pid=324&uid=5142336718844258043

0
345 B

40ms
39ms

Image
image/avif

18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=324&uid=5142336718844258043
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

Location: https://ads.servenobid.com/sync?pid=324&uid=5142336718844258043
Date: Fri, 17 Jun 2022 07:35:38 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK usa
sync.go.sonobi.com/ Frame 46F1 0
474 B 107ms
23ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/usa?loc=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D332%26uid%3D

Requested by

Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
ads.servenobid.com/ Frame 46F1
Redirect Chain

https://prebid.a-mo.net/cchain/0?gdpr=0&gdpr_consent=&us_privacy=1YN-&&cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D327%26uid%3D
https://ads.servenobid.com/sync?pid=327&uid=531f47f9-3e24-4740-86c8-a662ecad76d7&gdpr=0&gdpr_consent=&us_privacy=1YN-

0
357 B

41ms
39ms

Image
image/avif

18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=327&uid=531f47f9-3e24-4740-86c8-a662ecad76d7&gdpr=0&gdpr_consent=&us_privacy=1YN-
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=327&uid=531f47f9-3e24-4740-86c8-a662ecad76d7&gdpr=0&gdpr_consent=&us_privacy=1YN-
date: Fri, 17 Jun 2022 07:35:37 GMT
cache-control: max-age=0, private, must-revalidate
x-envoy-upstream-service-time: 0
server: envoy
content-length: 0

GET
H2

200

sync
ads.servenobid.com/ Frame 46F1
Redirect Chain

https://ups.analytics.yahoo.com/ups/58559/occ
https://ups.analytics.yahoo.com/ups/58559/occ?verify=true
https://ads.servenobid.com/sync?pid=337&uid=y-rSkrcydE2uGl7g.si36mhuWozCllD.Az0gVOmWo-~A

0
366 B

40ms
40ms

Image
image/avif

18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=337&uid=y-rSkrcydE2uGl7g.si36mhuWozCllD.Az0gVOmWo-~A
Requested by: Host: public.servenobid.com
URL: https://public.servenobid.com/sync.html
Protocol: H2
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://public.servenobid.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

Redirect headers

location: https://ads.servenobid.com/sync?pid=337&uid=y-rSkrcydE2uGl7g.si36mhuWozCllD.Az0gVOmWo-~A
date: Fri, 17 Jun 2022 07:35:38 GMT
server: ATS/9.1.0.46
age: 0
content-length: 0
strict-transport-security: max-age=31536000
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2 200 flimpobj.js Show response
pixel.yabidos.com/ Frame 3C50 31 KB
24 KB 28ms
28ms Script
application/javascript 104.16.201.58
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pixel.yabidos.com/flimpobj.js?cb=1655451338423&ver1=2.2.3&qid=83233313f553333313f513430313&rnd=el798i7rt3ty&cid=1041
Requested by: Host: pixel.yabidos.com
URL: https://pixel.yabidos.com/fltiu.js?qid=83233313f553333313f513430313&cid=1041&p=undefined&s=wheregoes.com
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 104.16.201.58 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4cf0498d6f16d928751dae8b235dab5e250f65d561f43e2dc20d982efac6016f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 12 May 2022 22:52:11 GMT
server: cloudflare
age: 1661
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 71ca1c113e0c692e-FRA
content-length: 24217
expires: Fri, 17 Jun 2022 09:35:38 GMT

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame B835 0
42 B 153ms
26ms Script
text/plain 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=16775413&p=0&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fx.yieldlift.com%2Fsetuid%3Fbidder%3Dpubmatic%26gdpr%3D0%26gdpr_consent%3D%26us_privacy%3D1YN-%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
content-length: 0

GET
H2

204

v1
ads.yahoo.com/cms/ Frame 1EB2
Redirect Chain

https://token.rubiconproject.com/token?pid=26594
https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L4I4ZCZF-B-6ILI&sigv=1&esig=2~1043da292c88dc6a38d2f1e2b3b8d9211436e015

0
194 B

87ms
26ms

Image
text/plain

2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L4I4ZCZF-B-6ILI&sigv=1&esig=2~1043da292c88dc6a38d2f1e2b3b8d9211436e015

Protocol

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
cache-control: no-store
x-content-type-options: nosniff
server: ATS
strict-transport-security: max-age=15552000
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-xss-protection: 1; mode=block

Redirect headers

Location: https://ads.yahoo.com/cms/v1?nwid=10000010181&eid=L4I4ZCZF-B-6ILI&sigv=1&esig=2~1043da292c88dc6a38d2f1e2b3b8d9211436e015
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 1EB2
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=wyGGoNtURZG_RszK5cHTPw&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=wyGGoNtURZG_RszK5cHTPw

43 B
556 B

116ms
115ms

Image
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=wyGGoNtURZG_RszK5cHTPw

Protocol

HTTP/1.1

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:39 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 7SPKJ1E8EV8MW9NN5FCK
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=wyGGoNtURZG_RszK5cHTPw
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 451 709414.gif
id.rlcdn.com/ Frame 1EB2 0
98 B 127ms
29ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/709414.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 1EB2
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=0XFBdK9-R6u7U_KURQxw_g&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=0XFBdK9-R6u7U_KURQxw_g

43 B
556 B

49ms
49ms

Image
image/gif

52.94.223.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=0XFBdK9-R6u7U_KURQxw_g

Protocol

HTTP/1.1

Server

52.94.223.37 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 26Q39RBBWYBXTG5NB2ZE
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=0XFBdK9-R6u7U_KURQxw_g
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 1EB2
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L4I4ZCZF-B-6ILI

0
707 B

238ms
146ms

Image
text/plain

2620:1ec:22::14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L4I4ZCZF-B-6ILI
Protocol: H2
Server: 2620:1ec:22::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 800FED752C3B4BB2992E37186003C4DA Ref B: VIEEDGE2817 Ref C: 2022-06-17T07:35:38Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXhn8z8cpSqKJKDlI8YZA==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=L4I4ZCZF-B-6ILI
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1EB2
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRJNFpDWkYtQi02SUxJ

170 B
232 B

75ms
40ms

Image
image/png

172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRJNFpDWkYtQi02SUxJ

Protocol

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDRJNFpDWkYtQi02SUxJ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 8f052d4f888ae4e0626c5f819879cacd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 1EB2
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/c4RCh-JAZ1O7lyt4VwQoVw?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=4631236784609371751

0
239 B

23ms
23ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=4631236784609371751
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

Redirect headers

date: Fri, 17 Jun 2022 07:35:38 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=4631236784609371751
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 1EB2 70 B
264 B 45ms
44ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 vbl.gif
pre.glotgrx.com/ Frame 3C50 26 B
303 B 84ms
32ms Image
image/gif 2606:4700::6810:77c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/vbl.gif?cb=1655451338489&rnd=el798i7rt3ty&ifm=1&uai=1&cid=1041&s=wheregoes.com&p=undefined&x=&adtg=&ats=0&atf=&nsi=&si=&nci=&nai=&pft=0&iip=0&adb=1&adc=0&adcd=i0_f0_o0_e0&ai=&icp=undefined&impid=&idl=&ttduid=&id5=&emh=
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1655451335073&secure=true&version=9&title=302%20Found%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:77c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
cf-cache-status: HIT
last-modified: Wed, 11 May 2022 17:13:28 GMT
server: cloudflare
age: 2548
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 71ca1c120cb38fda-FRA
content-length: 26
expires: Fri, 17 Jun 2022 09:35:38 GMT

GET
H2 200 nflrc.gif
pre.glotgrx.com/ Frame 3C50 26 B
87 B 86ms
34ms Image
image/gif 2606:4700::6810:77c3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pre.glotgrx.com/nflrc.gif?cb=1655451338478754&ver=1.2r81&qid=83233313f553333313f513430313&p=undefined&s=wheregoes.com&x=&cid=1041&od1=&od2=&adtg=&nci=&nai=&si=&ai=&nsi=&co=0&cstm1=&cstm2=&cstm3=&rnd=el798i7rt3ty&impid=&idl=&ttduid=&id5=&emh=&tps=2&ver1=2.2.3&1=8eeac0ccdde3fef97e6a15fcf986418f&2=0.0&3=1200_1600_1200_1600_24_24_1&5=%7B%220%22%3A%7B%220%22%3A%22Chrome%2520PDF%2520Plugin%2520-%2520%2520-%2520internal-pdf-viewer%2520-%2520Portable%2520Document%2520Formatfl_br%22%2C%221%22%3A%22Chrome%2520PDF%2520Viewer%2520-%2520%2520-%2520mhjfbmdgcfjbbpaeojofohoefgiehjai%2520-%2520fl_br%22%2C%222%22%3A%22Native%2520Client%2520-%2520%2520-%2520internal-nacl-plugin%2520-%2520fl_br%22%7D%7D&6=2&7={%22e%22:%2211%22,%22m%22:%220%22,%22f%22:%223428%22}&ats=0&atf=&dbgcid=1041&ifm=1&penv=b&pt=&ptbp=&tw=0&ldp=1&icpl=26&icp=https%253A//wheregoes.com/&irfl=26&irf=https%253A//wheregoes.com/&cty=4&fcs=0&flky=ver-fl-6-qid-fl-28-p-fl-9-s-fl-13-x-fl-0-cid-fl-4-od1-fl-0-od2-fl-0-adtg-fl-0-nci-fl-0-nai-fl-0-si-fl-0-ai-fl-0-nsi-fl-0-co-fl-0-cstm1-fl-0-cstm2-fl-0-cstm3-fl-0-rnd-fl-12-impid-fl-0-idl-fl-0-ttduid-fl-0-id5-fl-0-emh-fl-0-tps-fl-0-cb-fl-13-ver1-fl-5-&spfp=0&spfnp=0&sp1=Chromefl_andWindows&sp2=Chromefl_andWindows&adv=0&det=1&adb=1&iip=0&spf=0&adc=0&adcd=i0_f0_o0_e0&vps=0x0&gpu=Intel%20Iris%20OpenGL%20Engine&ncf=4g_9.8_undefined_null_0_undefined_false&chua={%22architecture%22:%22%22,%22brands%22:[],%22mobile%22:false,%22model%22:%22%22,%22platform%22:%22%22,%22platformVersion%22:%22%22,%22uaFullVersion%22:%22%22}&fli=&flerr=0&trim=&fio=20
Requested by: Host: mantodea.mantisadnetwork.com
URL: https://mantodea.mantisadnetwork.com/prebid/iframe?tz=0&buster=1655451335073&secure=true&version=9&title=302%20Found%20%7C%20WhereGoes&url=https%3A%2F%2Fwheregoes.com%2Fhttp-status-codes%2F302%2F
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6810:77c3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://mantodea.mantisadnetwork.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
cf-cache-status: HIT
last-modified: Wed, 11 May 2022 17:13:28 GMT
server: cloudflare
age: 2534
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/gif
cache-control: public, max-age=7200
accept-ranges: bytes
cf-ray: 71ca1c120cb68fda-FRA
content-length: 26
expires: Fri, 17 Jun 2022 09:35:38 GMT

GET
H2 200 sync
ads.servenobid.com/ Frame 68AA 0
344 B 41ms
41ms Image
image/avif 18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=317&uid=1885153015896016854&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H2 204 get_user_agent_id
cookie-matching.mediarithmics.com/v1/ Frame 68AA 0
86 B 103ms
29ms Image
text/plain 54.36.150.184
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cookie-matching.mediarithmics.com/v1/get_user_agent_id?dom_token=smart17&gdpr=0&gdpr_consent=

Requested by

Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.36.150.184 Paris, France, ASN16276 (OVH, FR),

Reverse DNS

ip184.ip-54-36-150.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000;includeSubDomains;preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
strict-transport-security: max-age=63072000;includeSubDomains;preload

GET
H2

200

gjIEMT18
sync-tm.everesttech.net/ct/upi/pid/ Frame 68AA
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=...

85 B
160 B

20ms
20ms

Image
image/png

151.101.194.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync-tm.everesttech.net/ct/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YqwuygAJcrsRZQAj
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: H2
Server: 151.101.194.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Jetty(9.4.35.v20201120) /
Resource Hash: acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
age: 562
x-served-by: cache-hhn4021-HHN
x-cache: HIT
content-type: image/png
cache-control: no-cache
accept-ranges: bytes
x-timer: S1655451339.691695,VS0,VE0
content-length: 85
x-cache-hits: 7168

Redirect headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1655451339.574232,VS0,VE94
x-served-by: cache-hhn4021-HHN
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location: https://sync-tm.everesttech.net/ct/upi/pid/gjIEMT18?redir=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D94%26partneruserid%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YqwuygAJcrsRZQAj
cache-control: no-cache
accept-ranges: bytes
access-control-allow-origin: *
content-length: 0
x-cache-hits: 0

GET
H/1.1

200
OK

/
rtb-csync.smartadserver.com/redir/ Frame 68AA
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://c1.adform.net/serving/cookie/match?CC=1&party=10&sspurl=https%3A%2F%2Frtb-csync.smartadserver.com%2Fredir%2F%3Fissi%3D1%26partnerid%3D22%26partneruserid%3DYOUR_USER_ID&gdpr=0&gdpr_consent=
https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=2405330139920002188&gdpr=0&gdpr_consent=

43 B
419 B

30ms
30ms

Image
image/gif

185.86.139.115
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=2405330139920002188&gdpr=0&gdpr_consent=
Requested by: Host: ssbsync.smartadserver.com
URL: https://ssbsync.smartadserver.com/api/sync?callerId=9&gdpr=0&gdpr_consent=&us_privacy=1YN-&&redirect=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D317%26uid%3D%24UID
Protocol: HTTP/1.1
Server: 185.86.139.115 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: 89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
cache-control: no-cache,no-store
content-type: image/gif
transfer-encoding: chunked
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Redirect headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
server: nginx
location: https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=22&partneruserid=2405330139920002188&gdpr=0&gdpr_consent=
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame 68AA
Redirect Chain

https://rtb-csync.smartadserver.com/redir/?issi=1&partnerid=135&partneruserid=TAM_OK&redirurl=https%3A%2F%2Fs.amazon-adsystem.com%2Fdcm%3Fpid%3D72348060-38ad-4586-8e4f-f1e2a8e789b3%26id%3DSMART_USE...
https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=1885153015896016854&gdpr=0&gdpr_consent=
https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=1885153015896016854&gdpr=0&gdpr_consent=&dcc=t

43 B
932 B

124ms
124ms

Image
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=1885153015896016854&gdpr=0&gdpr_consent=&dcc=t

Requested by

Protocol

HTTP/1.1

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssbsync.smartadserver.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:39 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: RD48DTK4AXX2707MSZGN
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: 70QDNJYGF2MJFVBAAVQY
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=72348060-38ad-4586-8e4f-f1e2a8e789b3&id=1885153015896016854&gdpr=0&gdpr_consent=&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://secure.adnxs.com/getuid?https://usersync.gumgum.com/usersync?b=apn&i=$UID
https://usersync.gumgum.com/usersync?b=apn&i=7724566457181376607

35 B
250 B

185ms
44ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=apn&i=7724566457181376607
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
X-Proxy-Origin: 217.114.218.21; 217.114.218.21; 535.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
AN-X-Request-Uuid: f786a943-fd48-4bde-a8dc-65254e85abc0
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://usersync.gumgum.com/usersync?b=apn&i=7724566457181376607
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://x.bidswitch.net/sync?ssp=gumgum2&user_id=e_4f58b04b-75eb-4f15-ad6c-0d7353278a4a&gdpr=0&gdpr_consent=&us_privacy=1---
https://x.bidswitch.net/ul_cb/sync?ssp=gumgum2&user_id=e_4f58b04b-75eb-4f15-ad6c-0d7353278a4a&gdpr=0&gdpr_consent=&us_privacy=1---
https://ads.avct.cloud/getuid?url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2
https://ads.avct.cloud/getuid?bounce=true&url=%2F%2Fx.bidswitch.net%2Fsync%3Fdsp_id%3D59%26user_id%3D%7B%7BUUID%7D%7D%26ssp%3Dgumgum2
https://x.bidswitch.net/sync?dsp_id=59&user_id=813b9a34-2c05-48f7-8e62-c11cdff9853b&ssp=gumgum2
https://usersync.gumgum.com/usersync?b=bsw&i=e37fae10-c61e-461b-833a-3827ee8d443a

35 B
250 B

44ms
44ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=bsw&i=e37fae10-c61e-461b-833a-3827ee8d443a
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: //usersync.gumgum.com/usersync?b=bsw&i=e37fae10-c61e-461b-833a-3827ee8d443a
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-sync
sync.outbrain.com/ Frame 36D8
Redirect Chain

https://sync.outbrain.com/redirectObuid?platformId=GUMGU18H7EL9NI653I7DPEH51&gdpr=0&gdprConsent=&platformRdUrl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dobn%26i%3D%7BOB_UID%7D%26r%3D%7BobR...
https://usersync.gumgum.com/usersync?b=obn&i=ENC%28lgZ4VkJ63r9SLa81R_FA3ZE_H2Hjeh-7vxroMdYj35m5-ydjlu5Oubp_q-CodG8O%29&r=https%3A%2F%2Fsync.outbrain.com%2FsyncUser%3FplatformId%3D%7Bplatform_id%7D%...
https://sync.outbrain.com/syncUser?platformId=GUMGU18H7EL9NI653I7DPEH51&platformUid=e_4f58b04b-75eb-4f15-ad6c-0d7353278a4a&obuid=ENC(lgZ4VkJ63r9SLa81R_FA3ZE_H2Hjeh-7vxroMdYj35m5-ydjlu5Oubp_q-CodG8O)
https://sync.outbrain.com/syncPartner?platformId=GUMGU18H7EL9NI653I7DPEH51
https://ssum-sec.casalemedia.com/usermatchredir?s=193091&cb=https%3A%2F%2Fsync.outbrain.com%2Fcookie-sync%3Fp%3Dindxexcg%26uid%3D%24%7BUSER%7D%26obUid%3DlgZ4VkJ63r9SLa81R_FA3ZE_H2Hjeh-7vxroMdYj35m5...
https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB&obUid=lgZ4VkJ63r9SLa81R_FA3ZE_H2Hjeh-7vxroMdYj35m5-ydjlu5Oubp_q-CodG8O

0
307 B

100ms
98ms

Image
text/plain

64.202.112.95
AS-OUTBRAIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB&obUid=lgZ4VkJ63r9SLa81R_FA3ZE_H2Hjeh-7vxroMdYj35m5-ydjlu5Oubp_q-CodG8O
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 64.202.112.95 Leesburg, United States, ASN22075 (AS-OUTBRAIN, US),
Reverse DNS: ny.outbrain.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Fri, 17 Jun 2022 07:35:39 GMT
Cache-Control: no-cache
X-TraceId: f1d97c723e4b8e4771fc879f8ef95284
Content-Length: 0

Redirect headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:39 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://sync.outbrain.com/cookie-sync?p=indxexcg&uid=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB&obUid=lgZ4VkJ63r9SLa81R_FA3ZE_H2Hjeh-7vxroMdYj35m5-ydjlu5Oubp_q-CodG8O
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 348
Expires: Fri, 17 Jun 2022 07:35:39 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://us-u.openx.net/w/1.0/cm?_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://us-u.openx.net/w/1.0/cm?cc=1&_={CACHEBUSTER}&id=47f31213-389c-4904-aaa6-9b11aab9c211&gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dopx%26i%3D
https://usersync.gumgum.com/usersync?b=opx&i=0d9ab96c-6b77-44bc-8ed7-524b229bc555

35 B
250 B

143ms
43ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=opx&i=0d9ab96c-6b77-44bc-8ed7-524b229bc555
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 17 Jun 2022 07:35:38 GMT
content-encoding: gzip
server: OXGW/7f1e280
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://usersync.gumgum.com/usersync?b=opx&i=0d9ab96c-6b77-44bc-8ed7-524b229bc555
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
via: 1.1 google

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=1&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sta&i=0-7f05dc70-2479-4237-5e40-fccbb90ab9ab$ip$217.114.218.21

35 B
250 B

43ms
43ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sta&i=0-7f05dc70-2479-4237-5e40-fccbb90ab9ab$ip$217.114.218.21
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=sta&i=0-7f05dc70-2479-4237-5e40-fccbb90ab9ab$ip$217.114.218.21
Date: Fri, 17 Jun 2022 07:35:38 GMT
Connection: keep-alive
Content-Length: 128
Content-Type: text/html; charset=utf-8

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/gumgum?gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=oth&i=y-NcjYpTdE2pdxqstfadmjTxE6WE9U52nzH5qR~A

35 B
250 B

129ms
44ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=oth&i=y-NcjYpTdE2pdxqstfadmjTxE6WE9U52nzH5qR~A
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 17 Jun 2022 07:35:38 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security: max-age=31536000
location: https://usersync.gumgum.com/usersync?b=oth&i=y-NcjYpTdE2pdxqstfadmjTxE6WE9U52nzH5qR~A
x-xss-protection: 1; mode=block
content-length: 0
x-content-type-options: nosniff

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://sync.ipredictive.com/d/sync/cookie/generic?partner=gumgum&cspid=9&append=1&cb=${ADELPHIC_CACHE_BUSTER}&gdpr=0&gdpr_consent=&us_privacy=1---&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fuser...
https://usersync.gumgum.com/usersync?b=vnt&i=157c5578-ee10-11ec-8668-ad5d60f5736e

35 B
250 B

45ms
44ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=vnt&i=157c5578-ee10-11ec-8668-ad5d60f5736e
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Location: https://usersync.gumgum.com/usersync?b=vnt&i=157c5578-ee10-11ec-8668-ad5d60f5736e
Date: Fri, 17 Jun 2022 07:35:38 GMT
Server: Apache-Coyote/1.1
Connection: keep-alive
Content-Length: 0
X-CI-RTID: 157c5579-ee10-11ec-8668-ad5d60f5736e

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://sync.technoratimedia.com/services?srv=cs&pid=65&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsnc%26i%3D%5BUSER_ID%5D
https://usersync.gumgum.com/usersync?b=snc&i=GDPR

35 B
250 B

43ms
43ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=snc&i=GDPR
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

date: Fri, 17 Jun 2022 07:35:38 GMT
via: 1.1 varnish
server: nginx
age: 0
location: https://usersync.gumgum.com/usersync?b=snc&i=GDPR
access-control-allow-methods: POST,GET,HEAD,OPTIONS
x-varnish: 109606242
access-control-allow-origin: https://g2.gumgum.com/
access-control-allow-credentials: true
content-length: 0

GET
H2 200 142
match.deepintent.com/usersync/ Frame 36D8 0
44 B 345ms
106ms Image
text/plain 38.91.45.7
DEEPINTENT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.deepintent.com/usersync/142?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Ddit%26i%3D%24%7BDI_USER_ID%7D
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 38.91.45.7 , United States, ASN398989 (DEEPINTENT, US),
Reverse DNS
Software: a /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
content-length: 0
server: a

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://b1sync.zemanta.com/usersync/gumgum/?puid=e_4f58b04b-75eb-4f15-ad6c-0d7353278a4a&gdpr=0&gdpr_consent=&us_privacy=1---&cb=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dzem%26i%3D__ZUID__
https://stags.bluekai.com/site/23178?id=oPnSj3wZLxHTqeP-tije&redir=https%3A%2F%2Fb1sync.zemanta.com%2Fusersync%2Fbluekai%2Fcallback%2F%3Fd%3DNB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LO...
https://b1sync.zemanta.com/usersync/bluekai/callback/?d=NB2HI4DTHIXS65LTMVZHG6LOMMXGO5LNM52W2LTDN5WS65LTMVZHG6LOMM7WEPL2MVWSMZLYMNUGC3THMU6WO5LNM52W2JTHMRYHEPJQEZUT232QNZJWUM3XLJGHQSCUOFSVALLUNFVGK...
https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=oPnSj3wZLxHTqeP-tije&us_privacy=1---

35 B
250 B

46ms
45ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=oPnSj3wZLxHTqeP-tije&us_privacy=1---
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:39 GMT
P3p: CP="We do not support P3P header."
Location: https://usersync.gumgum.com/usersync?b=zem&gdpr=0&i=oPnSj3wZLxHTqeP-tije&us_privacy=1---
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 123
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://ad.360yield.com/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://ad.360yield.com/ul_cb/server_match?partner_id=N&r=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Didi%26i%3D%7BPUB_USER_ID%7D
https://usersync.gumgum.com/usersync?b=idi&i=2dd58cf2-21e7-40b2-b400-69e70daa42b3

35 B
250 B

44ms
43ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=idi&i=2dd58cf2-21e7-40b2-b400-69e70daa42b3
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=idi&i=2dd58cf2-21e7-40b2-b400-69e70daa42b3
date: Fri, 17 Jun 2022 07:35:38 GMT
access-control-allow-origin: *
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

generic
match.adsrvr.org/track/cmf/ Frame 36D8
Redirect Chain

https://sync.1rx.io/usersync2/floor6?gdpr=0&gdpr_consent=&dspret=1&redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Drhy%26i%3D%5BRX_UUID%5D
https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4944143568

70 B
264 B

44ms
44ms

Image
image/gif

3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4944143568
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
server: Tengine
etag: RX3ec0cf92ba214cdabe5a753d934fbe02003
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
location: https://match.adsrvr.org/track/cmf/generic?ttd_pid=adconductor&ttd_tpi=1&rndcb=4944143568
cache-control: no-store, no-cache, must-revalidate
content-type: text/html
expires: 0

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://bh.contextweb.com/bh/rtset?pid=558355&ev=1&rurl=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpln%26i%3D%25%25VGUID%25%25
https://usersync.gumgum.com/usersync?b=pln&i=3fj4fst9JkxM&ev=1&pid=558355

35 B
250 B

44ms
43ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=pln&i=3fj4fst9JkxM&ev=1&pid=558355
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:39 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

strict-transport-security: max-age=15768000
server: Jetty(9.4.14.v20181114)
p3p: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language: de-DE
location: https://usersync.gumgum.com/usersync?b=pln&i=3fj4fst9JkxM&ev=1&pid=558355
cache-control: private, max-age=0, no-cache, no-store
cw-server: bh-deployment-stage-0
expires: -1

GET
H/1.1

200

usersync
usersync.gumgum.com/ Frame 36D8
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=15&redirectUri=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dsad%26i%3D%5Bssb_sync_pid%5D&gdpr=0&gdpr_consent=
https://usersync.gumgum.com/usersync?b=sad&i=1885153015896016854

35 B
250 B

44ms
44ms

Image
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://usersync.gumgum.com/usersync?b=sad&i=1885153015896016854
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://g2.gumgum.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Type: image/gif
Content-Length: 35
Expires: 0

Redirect headers

location: https://usersync.gumgum.com/usersync?b=sad&i=1885153015896016854
date: Fri, 17 Jun 2022 07:35:38 GMT
content-length: 0

GET sync
ads.servenobid.com/ Frame 36D8 0
0

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 97E7
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=71&gdpr=0&gdpr_consent=&redir=https%3a%2f%2fusersync.gumgum.com%2fusersync%3fb%3dmmh%26i%3d%5bMM_UUID%5d
https://usersync.gumgum.com/usersync?b=mmh&i=445662ac-2ecb-4400-94a5-989b208946af&gdpr=0&gdpr_consent=

35 B
250 B

44ms
43ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=mmh&i=445662ac-2ecb-4400-94a5-989b208946af&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 17 Jun 2022 07:35:39 GMT
Expires: 0
Pragma: no-cache

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 17 Jun 2022 07:35:39 GMT
Expires: Fri, 17 Jun 2022 07:35:38 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 4447 e18e916 master hkg-pixel-x1 config:1.0.0
location: https://usersync.gumgum.com/usersync?b=mmh&i=445662ac-2ecb-4400-94a5-989b208946af&gdpr=0&gdpr_consent=

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 3813
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=
https://sync-tm.everesttech.net/ct/upi/pid/URnmbSKM?redir=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Datm%26i%3D%24%7BTM_USER_ID%7D&gdpr=0&gdpr_consent=&_test=YqwuygAJjauKKwA2
https://usersync.gumgum.com/usersync?b=atm&i=YqwuygAJjauKKwA2&gdpr=0&gdpr_consent=&_test=YqwuygAJjauKKwA2

35 B
250 B

74ms
44ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=atm&i=YqwuygAJjauKKwA2&gdpr=0&gdpr_consent=&_test=YqwuygAJjauKKwA2
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 17 Jun 2022 07:35:38 GMT
Expires: 0
Pragma: no-cache

Redirect headers

accept-ranges: bytes
cache-control: no-cache
content-length: 0
date: Fri, 17 Jun 2022 07:35:38 GMT
location: https://usersync.gumgum.com/usersync?b=atm&i=YqwuygAJjauKKwA2&gdpr=0&gdpr_consent=&_test=YqwuygAJjauKKwA2
pragma: no-cache
retry-after: 0
server: Varnish
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 0
x-served-by: cache-hhn4021-HHN
x-timer: S1655451339.690231,VS0,VE0

GET
H2 200 pixel Show response
cm.g.doubleclick.net/ Frame 8351 170 B
502 B 90ms
39ms Document
image/png 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gumgum_dbm&google_hm=ZV80ZjU4YjA0Yi03NWViLTRmMTUtYWQ2Yy0wZDczNTMyNzhhNGE=&gdpr=0&gdpr_consent=

Requested by

Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 170
content-type: image/png
cross-origin-resource-policy: cross-origin
date: Fri, 17 Jun 2022 07:35:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
server: HTTP server (unknown)
x-xss-protection: 0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame 318E 15 KB
6 KB 25ms
25ms Document
text/html 23.35.236.201
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?predirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Dpbm%26i%3D&gdpr=0&gdprConsent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-201.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: ec24ec80719b83e32448bd568739a6b7c36f96cc746c3003a9d32a1ef4535152

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=60919
content-encoding: gzip
content-length: 5549
content-type: text/html; charset=UTF-8
date: Fri, 17 Jun 2022 07:35:38 GMT
etag: "1300708-3de4-5d6ef246ef4cf"
expires: Sat, 18 Jun 2022 00:30:57 GMT
last-modified: Tue, 01 Feb 2022 06:38:00 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache/2.2.15 (CentOS)
vary: Accept-Encoding

GET
H2 200 generic Show response
match.adsrvr.org/track/cmf/ Frame C0E6 70 B
264 B 54ms
53ms Document
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=gumgum&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private,no-cache, must-revalidate
content-length: 70
content-type: image/gif
date: Fri, 17 Jun 2022 07:35:38 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma: no-cache
x-aspnet-version: 4.0.30319

GET
H/1.1

200

usersync Show response
usersync.gumgum.com/ Frame 61E4
Redirect Chain

https://cs.emxdgt.com/um?redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24UID&gdpr=0&gdpr_consent=
https://ib.adnxs.com/getuid?https://cs.emxdgt.com/umcheck?apnxid=$UID&redirect=https%3A%2F%2Fusersync.gumgum.com%2Fusersync%3Fb%3Demx%26i%3D%24EMXUID
https://cs.emxdgt.com/umcheck?apnxid=7724566457181376607&redirect=https://usersync.gumgum.com/usersync?b=emx&i=$EMXUID
https://usersync.gumgum.com/usersync?b=emx&uid=7724566457181376607brt012331655451338640376f1

35 B
250 B

47ms
45ms

Document
image/gif

52.210.15.1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://usersync.gumgum.com/usersync?b=emx&uid=7724566457181376607brt012331655451338640376f1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.210.15.1 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-210-15-1.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif
Date: Fri, 17 Jun 2022 07:35:38 GMT
Expires: 0
Pragma: no-cache

Redirect headers

content-length: 0
content-type: text/html
date: Fri, 17 Jun 2022 07:35:37 GMT
location: https://usersync.gumgum.com/usersync?b=emx&uid=7724566457181376607brt012331655451338640376f1

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 74F0
Redirect Chain

https://tg.socdm.com/aux/idsync?proto=gumgum
https://rtb.gumgum.com/usersync?b=sus&i=Yqwuy8Co8YUAAH4Na0cAAAAA

35 B
208 B

52ms
52ms

Document
image/gif

52.50.3.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=sus&i=Yqwuy8Co8YUAAH4Na0cAAAAA
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.3.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-3-118.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Fri, 17 Jun 2022 07:35:39 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 0
Date: Fri, 17 Jun 2022 07:35:39 GMT
Location: https://rtb.gumgum.com/usersync?b=sus&i=Yqwuy8Co8YUAAH4Na0cAAAAA
P3P: CP="See also http://www.scaleout.jp/privacy/"
Server: nginx
X-SO-Ads-Time: 4
X-SO-Cluster-ID: 63
X-SO-HostName: m-ad31.dc4p.scaleout.jp
X-SO-IP: 217.114.218.21
X-SO-Key: Yqwuy8Co8YUAAH4Na0cAAAAA
X-SO-LB-Data: {"ban":false,"clean_query":"\/aux\/idsync?proto=gumgum","cluster_id":63,"gdpr":true,"ipv4":"0.0.0.0","key":"Yqwuy8Co8YUAAH4Na0cAAAAA","privacy_sensitive":true,"uid":"","upstream_id":"m-ad31"}
X-SO-LB-Hostname: m-tgng33.dc4p.scaleout.jp
X-SO-Upstream-ID: m-ad31

GET
H2

200

usersync Show response
rtb.gumgum.com/ Frame 4676
Redirect Chain

https://creativecdn.com/cm-notify?pi=gumgum
https://creativecdn.com/cm-notify?pi=gumgum&tc=1
https://rtb.gumgum.com/usersync?b=rth&i=QznHleGH6pvVjC3c4NLg&pi=gumgum&tc=1

35 B
208 B

54ms
46ms

Document
image/gif

52.50.3.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.gumgum.com/usersync?b=rth&i=QznHleGH6pvVjC3c4NLg&pi=gumgum&tc=1
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.3.118 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-3-118.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1ed70d02696722505ec82915a7dd9fbf2c512366d009b74bdbe37c9869c250a4

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-store, must-revalidate, max-age=0
content-length: 35
content-type: image/gif;charset=UTF-8
date: Fri, 17 Jun 2022 07:35:38 GMT
expires: 0
pragma: no-cache
server: nginx
timing-allow-origin: *

Redirect headers

cache-control: no-cache, no-store, must-revalidate, private, max-age=0
content-length: 0
date: Fri, 17 Jun 2022 07:35:38 GMT Fri, 17 Jun 2022 07:35:38 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://rtb.gumgum.com/usersync?b=rth&i=QznHleGH6pvVjC3c4NLg&pi=gumgum&tc=1
pragma: no-cache

GET
H/1.1

200
OK

usync.html Show response
eus.rubiconproject.com/ Frame B96A
Redirect Chain

https://secure-assets.rubiconproject.com/utils/xapi/multi-sync.html?p=gumgum
https://eus.rubiconproject.com/usync.html?p=gumgum

281 B
554 B

20ms
19ms

Document
text/html

104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Requested by: Host: g2.gumgum.com
URL: https://g2.gumgum.com/usync/13926?gdpr=0&gdpr_consent=&us_privacy=1---&r=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D309%26uid%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://g2.gumgum.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 17 Jun 2022 07:35:38 GMT
ETag: "402b2-119-5d32342a551c0"
Last-Modified: Tue, 14 Dec 2021 23:07:59 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
content-length: 0
date: Fri, 17 Jun 2022 07:35:38 GMT
location: https://eus.rubiconproject.com/usync.html?p=gumgum
server: AkamaiGHost

GET
H/1.1

200
OK

dcm
s.amazon-adsystem.com/ Frame B9A6
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB
https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB&dcc=t

43 B
645 B

115ms
114ms

Image
image/gif

209.54.180.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB&dcc=t

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

HTTP/1.1

Server

209.54.180.144 Ashburn, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:39 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: F8AAY6CQ4Q60DQCPKDDT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Vary: Content-Type,Accept-Encoding,X-Amzn-CDN-Cache,X-Amzn-AX-Treatment,User-Agent
Server: Server
x-amz-rid: TTHVNJNZH0XC30D1ZXEN
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/dcm?pid=78af914c-e755-4b90-bded-1b172aedc763&us_privacy=&gdpr=1&gdpr_consent=&id=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Permissions-Policy: interest-cohort=()
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 200 pixel
cm.g.doubleclick.net/ Frame B9A6 170 B
188 B 77ms
34ms Image
image/png 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_cm&google_hm=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB&gdpr_consent=&us_privacy=&gdpr=1

Requested by

Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 casale
match.adsrvr.org/track/cmf/ Frame B9A6 70 B
264 B 48ms
44ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/casale?gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame B9A6
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=1&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dbm%26google_cm%26google_sc%26google_hm%3D&gdpr=1
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=casale_media2_dbm&google_cm&google_sc&google_hm=YqwuygVpTT-rIA3Ze4uYVgAA
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENC-EWFj3THNYm4zSmL_11c&google_cver=1&gdpr=1

43 B
783 B

61ms
48ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENC-EWFj3THNYm4zSmL_11c&google_cver=1&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 17 Jun 2022 07:35:38 GMT

Redirect headers

pragma: no-cache
date: Fri, 17 Jun 2022 07:35:38 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=45&external_user_id=CAESENC-EWFj3THNYm4zSmL_11c&google_cver=1&gdpr=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 325
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 400
Request failed due to privacy signals getuid
ib.adnxs.com/ Frame B9A6 0
0 24ms
22ms Image
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ib.adnxs.com/getuid?https://dsum.casalemedia.com/crum?cm_dsp_id=190&external_user_id=$UID&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS: 867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

GET
H/1.1 200
OK ibs:dpid=23728&dpuuid=YqwuygVpTT-rIA3Ze4uYVgAA%261207
dpm.demdex.net/ Frame B9A6 0
0 171ms
41ms Image
application/json 34.242.80.80
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dpm.demdex.net/ibs:dpid=23728&dpuuid=YqwuygVpTT-rIA3Ze4uYVgAA%261207?gdpr_consent=&us_privacy=&gdpr=1
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.242.80.80 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-242-80-80.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

GET
H2 204 CookieIndex
rtb.adentifi.com/ Frame B9A6 0
35 B 322ms
104ms Image
text/plain 50.17.173.185
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.adentifi.com/CookieIndex
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.17.173.185 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-50-17-173-185.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT

GET
H/1.1

200
OK

crum
dsum-sec.casalemedia.com/ Frame B9A6
Redirect Chain

https://d.adroll.com/cm/index/ssp?gdpr=1
https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0

43 B
783 B

78ms
53ms

Image
image/gif

92.122.147.230
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: HTTP/1.1
Server: 92.122.147.230 Milan, Italy, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a92-122-147-230.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 17 Jun 2022 07:35:38 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Fri, 17 Jun 2022 07:35:38 GMT

Redirect headers

location: https://dsum-sec.casalemedia.com/crum?cm_dsp_id=105&external_user_id=0
date: Fri, 17 Jun 2022 07:35:38 GMT
server: nginx/1.20.0
content-length: 76

GET
H2 200 sync
ads.servenobid.com/ Frame B9A6 0
357 B 42ms
39ms Image
image/avif 18.200.101.3
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.servenobid.com/sync?pid=333&uid=YqwuygVpTT_rIA3Ze4uYVgAABLcAAAIB
Requested by: Host: ssum-sec.casalemedia.com
URL: https://ssum-sec.casalemedia.com/usermatch?cb=https%3A%2F%2Fads.servenobid.com%2Fsync%3Fpid%3D333%26uid%3D&s=195491&C=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.200.101.3 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-200-101-3.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ssum-sec.casalemedia.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

date: Fri, 17 Jun 2022 07:35:38 GMT
amp-access-control-allow-source-origin: *
content-type: image/avif;charset=ISO-8859-1
access-control-allow-origin: *
access-control-expose-headers: AMP-Access-Control-Allow-Source-Origin
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame B96A 31 KB
10 KB 22ms
21ms Script
text/html 104.92.74.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.92.74.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-92-74-8.deploy.static.akamaitechnologies.com
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c8a778d5fa59d4a504855f9230149b9b3d99a13bf9a3fcf984c9c4d19203a118

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html?p=gumgum
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Date: Fri, 17 Jun 2022 07:35:38 GMT
Content-Encoding: gzip
Last-Modified: Thu, 09 Jun 2022 17:17:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=33711
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Content-Length: 9454
Expires: Fri, 17 Jun 2022 16:57:29 GMT

GET
H/1.1 204
No Content sync.php
pixel.rubiconproject.com/exchange/ Frame B96A 0
239 B 40ms
23ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/exchange/sync.php?p=gumgum&khaos=L4I4ZCZF-B-6ILI
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html?p=gumgum
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.115 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 704c1e4d3fcc922a3031d436b584678b
Content-Type: image/gif

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame C3B1 0
745 B 21ms
21ms Script
text/html 37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS