utua.com.br Open in urlscan Pro
2606:4700:10::6816:129 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://u28949501.ct.sendgrid.net/ls/click?upn=u001.0GAB1Y74DEsfIzAXYkw1SbMsmSBfnalmebD5OgSNWhn6H03A9YC1J20Uxe9Dd-2B-2FnvOVP6YDVRp...
Effective URL:
https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-e...
Submission: On March 05 via manual (March 5th 2024, 12:26:22 pm UTC) from TH — Scanned from DE

Summary HTTP 137 Redirects Behaviour Indicators

Summary

This website contacted 28 IPs in 4 countries across 20 domains to perform 137 HTTP transactions. The main IP is 2606:4700:10::6816:129, located in United States and belongs to CLOUDFLARENET, US. The main domain is utua.com.br. The Cisco Umbrella rank of the primary domain is 507463.
TLS certificate: Issued by E1 on January 12th 2024. Valid for: 3 months.

This is the only time utua.com.br was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	167.89.123.147 167.89.123.147	11377 (SENDGRID) (SENDGRID)
1 1	143.204.98.106 143.204.98.106	16509 (AMAZON-02) (AMAZON-02)
5	2606:4700:10:... 2606:4700:10::6816:129	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:808::200a	15169 (GOOGLE) (GOOGLE)
1 7	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:551	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
1	2606:4700:20:... 2606:4700:20::681a:451	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
4	2001:4860:480... 2001:4860:4802:32::35	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:806::2001	15169 (GOOGLE) (GOOGLE)
41	2a00:1450:400... 2a00:1450:4001:80b::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
20	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
1 1	35.166.159.2 35.166.159.2	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223f:c600:8:48e:53c0:93a1	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
3 4	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
2 4	172.64.151.101 172.64.151.101	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	185.89.210.82 185.89.210.82	29990 (ASN-APPNEX) (ASN-APPNEX)
2	142.250.185.130 142.250.185.130	15169 (GOOGLE) (GOOGLE)
11	2a00:1450:400... 2a00:1450:4001:81c::2006	15169 (GOOGLE) (GOOGLE)
2	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1 2	52.19.228.126 52.19.228.126	16509 (AMAZON-02) (AMAZON-02)
1	213.202.235.8 213.202.235.8	24961 (MYLOC-AS ...) (MYLOC-AS IP Backbone of myLoc managed IT AG)
1	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
137	28

1 167.89.123.147 (Chicago, United States) 1 redirects

ASN11377 (SENDGRID, US)
PTR: o16789123x147.outbound-mail.sendgrid.net

u28949501.ct.sendgrid.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.106 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-106.fra50.r.cloudfront.net

wizrocketmail.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2606:4700:10::6816:129 (United States)

ASN13335 (CLOUDFLARENET, US)

utua.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bucket.utua.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:551 (United States)

ASN13335 (CLOUDFLARENET, US)

assets.begrowth.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:20::681a:451 (United States)

ASN13335 (CLOUDFLARENET, US)

location.begrowth.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:4860:4802:32::35 (United States)

ASN15169 (GOOGLE, US)

growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:806::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

41 2a00:1450:4001:80b::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.166.159.2 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-166-159-2.us-west-2.compute.amazonaws.com

pixel.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223f:c600:8:48e:53c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.162 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.64.151.101 (San Francisco, United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.82 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s50-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:81c::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.19.228.126 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-228-126.eu-west-1.compute.amazonaws.com

skydeutschland.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.202.235.8 (Germany)

ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE)

m.exactag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
65	googlesyndication.com 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com tpc.googlesyndication.com — Cisco Umbrella Rank: 161 pagead2.googlesyndication.com — Cisco Umbrella Rank: 104	806 KB
16	doubleclick.net 4 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 214 stats.g.doubleclick.net — Cisco Umbrella Rank: 84 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 cm.g.doubleclick.net — Cisco Umbrella Rank: 271 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 562	317 KB
11	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 321	395 KB
8	ampproject.org cdn.ampproject.org — Cisco Umbrella Rank: 397	148 KB
8	gstatic.com fonts.gstatic.com www.gstatic.com	87 KB
7	google.com region1.analytics.google.com — Cisco Umbrella Rank: 2656 www.google.com — Cisco Umbrella Rank: 2	2 KB
5	utua.com.br utua.com.br — Cisco Umbrella Rank: 507463 bucket.utua.com.br — Cisco Umbrella Rank: 719315	38 KB
4	casalemedia.com 2 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 631	2 KB
4	run.app growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app — Cisco Umbrella Rank: 712414	88 B
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	3 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 256	3 KB
2	demdex.net 1 redirects skydeutschland.demdex.net — Cisco Umbrella Rank: 64350	1 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 124
2	adsafeprotected.com 1 redirects pixel.adsafeprotected.com — Cisco Umbrella Rank: 831 static.adsafeprotected.com — Cisco Umbrella Rank: 673	698 B
2	begrowth.com.br assets.begrowth.com.br — Cisco Umbrella Rank: 595283 location.begrowth.com.br — Cisco Umbrella Rank: 644530	20 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	188 KB
1	exactag.com m.exactag.com — Cisco Umbrella Rank: 12613	60 B
1	google.de www.google.de — Cisco Umbrella Rank: 6744	408 B
1	wizrocketmail.net 1 redirects wizrocketmail.net — Cisco Umbrella Rank: 86624	783 B
1	sendgrid.net 1 redirects u28949501.ct.sendgrid.net	802 B
137	20

	Domain	Requested by
41	tpc.googlesyndication.com	utua.com.br 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com cdn.ampproject.org tpc.googlesyndication.com s0.2mdn.net securepubads.g.doubleclick.net
20	pagead2.googlesyndication.com	5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com utua.com.br pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com s0.2mdn.net securepubads.g.doubleclick.net
11	s0.2mdn.net	utua.com.br s0.2mdn.net 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
8	cdn.ampproject.org	securepubads.g.doubleclick.net 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
7	securepubads.g.doubleclick.net	1 redirects utua.com.br securepubads.g.doubleclick.net
6	www.gstatic.com	5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com utua.com.br
6	region1.analytics.google.com	www.googletagmanager.com
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	cm.g.doubleclick.net	3 redirects googleads.g.doubleclick.net
4	growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app	assets.begrowth.com.br
4	5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
4	fonts.googleapis.com	utua.com.br 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
4	utua.com.br	utua.com.br
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
2	skydeutschland.demdex.net	1 redirects 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
2	googleads4.g.doubleclick.net	utua.com.br
2	www.googleadservices.com	utua.com.br
2	googleads.g.doubleclick.net	5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com pagead2.googlesyndication.com
2	fonts.gstatic.com	fonts.googleapis.com
2	www.googletagmanager.com	utua.com.br www.googletagmanager.com
1	www.google.com	tpc.googlesyndication.com
1	m.exactag.com	5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
1	static.adsafeprotected.com	5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
1	pixel.adsafeprotected.com	1 redirects
1	www.google.de	utua.com.br
1	stats.g.doubleclick.net	www.googletagmanager.com
1	location.begrowth.com.br	assets.begrowth.com.br
1	assets.begrowth.com.br	utua.com.br
1	bucket.utua.com.br	utua.com.br
1	wizrocketmail.net	1 redirects
1	u28949501.ct.sendgrid.net	1 redirects
137	31

This site contains no links.

Subject Issuer	Validity	Valid
utua.com.br E1	`2024-01-12` - `2024-04-11`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-25` - `2024-05-24`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
begrowth.com.br GTS CA 1P5	`2024-01-08` - `2024-04-07`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
www.google.de GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.a.run.app GTS CA 1C3	`2024-02-05` - `2024-04-29`	3 months	crt.sh
misc-sni.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.exactag.com Sectigo RSA Organization Validation Secure Server CA	`2023-04-03` - `2024-05-03`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh

This page contains 14 frames:

Primary Page: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0
Frame ID: 14BE9D0C0348873281BCA5760DC61D10
Requests: 28 HTTP requests in this frame

Frame: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 39456926B01ABDB5BB0AF647E7D10F2C
Requests: 1 HTTP requests in this frame

Frame: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 2754C46F5870EB806AEB39B5A2DD4625
Requests: 21 HTTP requests in this frame

Frame: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: BFB673CECFCDF8EA3CA97698AF3A35A7
Requests: 13 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs
Frame ID: 0B63D5114D9A74490A74D42BA15BDA7F
Requests: 34 HTTP requests in this frame

Frame: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: ADDD551DE07787E49EC1FDF22F2CE4D0
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIjTkokCMAE&v=APEucNX7W2i22jxFFhbeRIYYLcLwxmCDl_Jw82QyNJUpI8dumEuaG2_IhbG6dKA5JV-SU9RtI-xmfo6Z33d6x5hM5sz7Y-MdKfEoCoCKc40a2CBI6RaEqPJc-XNgzKLnPGSGQ269EsSrDx5z_qrk15vYAhSMOaTvhVKXuK4Bak-zT25BP9_iZqU
Frame ID: 10957B58CE882014768C5E302F685C24
Requests: 5 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Poppins%3A400%2C600
Frame ID: 18D53B3700715D57C75127CEE58B7155
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js
Frame ID: 758A4FE1E416E3EA2FE0567E6C79B9E6
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/62bHydCX.html
Frame ID: DAE4A39591AB0D4B56E49F66DF1A03DE
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250
Frame ID: C72B23E341EA0D5C0DA7B2D82322BAEF
Requests: 12 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/hhT7r2j7IM84IjrHPq4DliozylkjplqSUN38T7c3Pqk.js
Frame ID: E1C88AB0B995B03175A448FF0A2BCD74
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: DA422625444E0002E79009460EC58AB7
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 9B68480911E1F6A2C7D9E40875D9CB9F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

กู้ง่ายธนาคารไทยพาณิชย์ อนุมัติเร็ว

Page URL History Show full URLs

https://u28949501.ct.sendgrid.net/ls/click?upn=u001.0GAB1Y74DEsfIzAXYkw1SbMsmSBfnalmebD5OgSNWhn6H03A9YC1J20Uxe... HTTP 302
https://wizrocketmail.net/r?e=K2xrcx8EBQF6CGR9DSZmewsDBQwpJCw8KSQsfwIJAgBvJhILJD8hOFtfX2s0NT0gPj8SC04B... HTTP 302
https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaig... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Page Statistics

137
Requests

95 %
HTTPS

67 %
IPv6

20
Domains

31
Subdomains

28
IPs

4
Countries

2008 kB
Transfer

4674 kB
Size

25
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://u28949501.ct.sendgrid.net/ls/click?upn=u001.0GAB1Y74DEsfIzAXYkw1SbMsmSBfnalmebD5OgSNWhn6H03A9YC1J20Uxe9Dd-2B-2FnvOVP6YDVRpWEL9jWRoBN3X-2BkQOJA9OmxWQoyktDd1NQ-2B5Q8HMbb3UGitK2zucbA6-2BiRGM36N3Vz4VILwpIfhnvmxxKr9a1H-2Bc6ZixxHpIKr5hU0lbescMWb1qpfayNZ9taG-2Fhr2rkFSFc6hvobUIRfLibtZKpxyXFqMipN4E8XJONdiqSITy0feI0-2Fv1xRFPLp5LeQV2bIq-2BgkrdjzRN8cjG5BMEeo763Cuc2BkfKnRIkBtL4MGKokgcpWNFcV2GYKQgArkfOPf6LJJ4IjaVpUFgEejeynSqoAM-2BwsvH2aDjaEPJZfn-2Bd2ZrCmuC61LVOQ8MUCpBCwW-2FtWbJtVE5A8C4kerA3hzeELiU2nIwdfNsSHpeLgoKAAcSO9-2BzxW65leIV-2FmaTIijkkWmnuSLp2nB3k8Usvdixxq4tr1H-2BybhYiJVCyEQ7-2FoldoQAMJxaXViO-2FVsWCGa0xfVyVij2I3q9jgiOFaGGWmXO2Q7skoWC5CYNWje76ONAR6-2FQyyzEiTLhSfqMeJT1XrxbYOoBPQI6enAK56Ux9vba5-2FEC-2BaUojiHrddDDvS0eWwsu31pKkQUh-2FOpWY5kpA53A4MLzKZf2ViSfThLeriKqIw2a0Ke5euFAj1PvNyFoQiSBJVVC98RkZ-2B27CSWfAU3WILdbu4qYd6ydYUs4gAmOBoWxfRABPkv1rUzZgytWTbugagA-2BwmXtDW1qlyK9mBe1k38CUZXx09vJpezth8zilSFikMcY-3DfbiA_dWaeq-2BcXoznqI0YmaOtA1bwGdDTGbZz4kcpfE6OYcsCkwGRwE-2BILYYZQ0EFZBrfLzQFX0S-2Fl6YdujmCPY5tmoBFH7hexTuOet1JktPU48ghZCII1SvVL6XnoSG0m6uhszMt8ZbBnnmfXNIqlGaTJqhQywMGvsWPBkgobN8EUrdjYpgILr6cdqdCenS-2F1UWddCrRdkXCcdYcC3Te9FEPsTW7O0RS1Kz54l9oK5OKtb2NLGM2LwAvuw57-2Bw5TkFH1bB4qLZfhh73dj6v1rgGXQQPna76gbA6q239pRAKHyZcA-2FxjHX6VafOMsvHgmGYfPm7168QdWt6gCX5aaWQFFpfIJqGMb4iTxKBWtr6obq2dm3Yn8PGlBeoa8N93toxslwOv-2BWJclwghMOIwQ9gXOfFUfXyajnEAAK4Vkvwl3ftGm-2BK9n57KQVrvyIP41U8-2BlvmZ1eHkrvTfsoO0vIs8Ox8xJfnBADKLB9ijJUcE39I-2Bs-3D HTTP 302
https://wizrocketmail.net/r?e=K2xrcx8EBQF6CGR9DSZmewsDBQwpJCw8KSQsfwIJAgBvJhILJD8hOFtfX2s0NT0gPj8SC04BTVEhPzw%2FKxQ9P1tWWFc2LjskOXoRJ1tTWlEzJilpICAgIG1ZVRZteGN8Z2pkcgEFAg0IaGJ5Y2phewYSHRYgICAgCCo7PV1EEw51DDM5Pjs8PxJyE0k%3D&r=https%3A%2F%2Futua.com.br%2Fth-emp-scb-speedy-loan-p1%2F%3Futm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00%26an_uid%3D06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0&c=649440576&token=BlJUAwtbBwkFAA%3D%3D&try=1&$follow_redirect=true HTTP 302
https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54

https://pixel.adsafeprotected.com/rfw/st/1878143/78738416/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1015562965&ias_pubId=pub-1757064723917999&ias_chanId=1&ias_placementId=20884485503&bidurl=https://utua.com.br/th-emp-scb-speedy-loan-p1/&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0iV_DhXqTgR_mOREMyl8jCa HTTP 302
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&ias_xappb=

Request Chain 78

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKMAAd7uxqgrB3k6CCA7eLs&google_cver=1

Request Chain 79

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZecPaVVbLWMAAHUzABh1twAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKMAAd7uxqgrB3k6CCA7eLs&google_cver=1

Request Chain 80

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESECfApMXdjBXyTL-I-0SdQt4&google_cver=1

Request Chain 81

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU5MjY1MDQ3NTkzNjk0NjIwNA%3D%3D

Request Chain 100

https://securepubads.g.doubleclick.net/pagead/adview?ai=C9MuzaA_nZbbPC-PF7_UPtv27sA2zqMyddrfHs_OdEtnZHhABIJ_O9n1glYKAgJgHoAGLvOjsA8gBAakCuyUFCNUzsj7gAgCoAwHIAwqqBIoCT9CzOBZQAD7wZB96c_QQF3xXQpTvemzroc8iPoqxQnhOtUMKFTd9jRiYRiYxKaGYXfwRMCMtuXHhTTyoIkyAfgl--35TyxY1WA-9ebK7U80XExkwRmBrOuwv8ujNubyIP6ndo08NHQC9iOgKHDZpj3jtNq95mp16d_sfYrdobv7QrffIRUtw-8isKQQGh_jyxkyb-UOx2brgVoGwPo0177-xYI1G6vMevbI50P8_wXT6NY8A3ypbxxzl2ToGvZ10YfKPMkGXIUB6r008wMv_9kPgKuuNQVwRgHins9aP6u8GSiWBvSxTlAnOV9kgepLKl_VWz3KnkDmnb_uqymCR7V0jsnOTMpeA5p7ABJL88uDTA-AEAYgF5-Cn2jeSBQQIBBgBkgUECAUYBIAH3cOXE6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4b2AcB8gcGEJj-8YoB0ggrCIDhgBAQARgdMgeqgoDgn4ANOgmAQICAhICAlChIvf3BOliE-NuWj92EA5oJM2h0dHBzOi8vd3d3LmhhbnNlYXRpY2JhbmsuZGUva3JlZGl0a2FydGUvZ2VuaWFsY2FyZIAKA8gLAeINEwjV-9yWj92EAxXj4rsIHbb-DtbYEwyIFAHQFQGAFwGyFx4KHAgAEhRwdWItNDk3OTk3NzQ2MzgzMzAyNBiZgXQ&sigh=cppiGvb088A&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwB7FLtqNbSR_dBT_i2L76yBmnSmUWXU-FaRVQF-gXSYjlaQqgMtuxK0cHWnFyT9IbsJk33qwNgjRPRlp0a6EdyVpj6gtZkjj0UDu3kaY90YAQ&cbvp=2&vis=1&nis=5 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227172766446589546145%22,%22debug_reporting%22:true,%22destination%22:%22https://hanseaticbank.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221033510411%22],%2222%22:[%22true%22],%224%22:[%2203-05%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2212281036437342063281%22}&andc=true

Request Chain 110

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184943439&d_placement=389373594&d_campaign=31624803&d_bust=3524584831&gdpr=&gdpr_consent= HTTP 302
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184943439&d_placement=389373594&d_campaign=31624803&d_bust=3524584831&gdpr=&gdpr_consent=

137 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
utua.com.br/th-emp-scb-speedy-loan-p1/
Redirect Chain

https://u28949501.ct.sendgrid.net/ls/click?upn=u001.0GAB1Y74DEsfIzAXYkw1SbMsmSBfnalmebD5OgSNWhn6H03A9YC1J20Uxe9Dd-2B-2FnvOVP6YDVRpWEL9jWRoBN3X-2BkQOJA9OmxWQoyktDd1NQ-2B5Q8HMbb3UGitK2zucbA6-2BiRGM36...
https://wizrocketmail.net/r?e=K2xrcx8EBQF6CGR9DSZmewsDBQwpJCw8KSQsfwIJAgBvJhILJD8hOFtfX2s0NT0gPj8SC04BTVEhPzw%2FKxQ9P1tWWFc2LjskOXoRJ1tTWlEzJilpICAgIG1ZVRZteGN8Z2pkcgEFAg0IaGJ5Y2phewYSHRYgICAgCCo7P...
https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui...

83 KB
20 KB

926ms
785ms

Document
text/html

2606:4700:10::6816:129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.4.33
Resource Hash: a9e33327dc1c082d5807d6a3db066134be1653f9336e867cc6d681ec51d0c335

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, max-age=300
cf-cache-status: MISS
cf-ray: 85fa17e44a0e9bdc-FRA
content-encoding: br
content-type: text/html; charset=UTF-8
date: Tue, 05 Mar 2024 12:26:15 GMT
last-modified: Tue, 05 Mar 2024 12:26:15 GMT
link: <https://utua.com.br/wp-json/>; rel="https://api.w.org/" <https://utua.com.br/wp-json/wp/v2/posts/23950>; rel="alternate"; type="application/json" <https://utua.com.br/?p=23950>; rel=shortlink
server: cloudflare
vary: Accept-Encoding
via: 1.1 google, 1.1 google
x-cloud-trace-context: 2a5755935d6db46c5c4f0730497991a6
x-powered-by: PHP/7.4.33

Redirect headers

Cache-Control: no-cache, no-store no-cache, no-store
Connection: keep-alive
Content-Length: 0
Date: Tue, 05 Mar 2024 12:26:14 GMT
Expires: 0
Location: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0
Pragma: no-cache
Strict-Transport-Security: max-age=31536000;includeSubDomains;preload
Via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 9HKwzoxQIXrTmKnc2FXKnb7CEtrTJvkmMQe4Q-EMwafNA7KAmD-pGw==
X-Amz-Cf-Pop: FRA50-C1
X-Cache: Miss from cloudfront
X-Frame-Options: SAMEORIGIN

GET
H2 200 css2
fonts.googleapis.com/ 848 B
827 B 81ms
33ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=DM+Sans&display=swap

Requested by

Host: utua.com.br
URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

c7dae6228d5c6b272885ca8b925bfa63c90df71ed4c7fc94e036bd37e8e453a1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Mar 2024 12:26:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 11:35:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Mar 2024 12:26:15 GMT

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 88 KB
28 KB 108ms
60ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b5d113f0bbd1580311da5a7e50e8991dcdfb434f983b02d4309cd732a7b8c589

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28636
x-xss-protection: 0
server: cafe
etag: 48 / 19787 / m202402220101 / config-hash: 2711866947856044050
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 05 Mar 2024 12:26:15 GMT

GET
H2 200 classic-themes.min.css
utua.com.br/wp-includes/css/ 291 B
321 B 41ms
38ms Stylesheet
text/css 2606:4700:10::6816:129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://utua.com.br/wp-includes/css/classic-themes.min.css?ver=6.2
Requested by: Host: utua.com.br
URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:15 GMT
via: 1.1 google, 1.1 google
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 04 Mar 2024 12:01:05 GMT
server: cloudflare
age: 75166
etag: W/"123-612d47aed4240-gzip"
vary: Accept-Encoding
content-type: text/css
x-cloud-trace-context: 9df0e4c3f6ffb0716c08d3c0b212e10d
cache-control: private, max-age=300
cf-ray: 85fa17e949a09bdc-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 style.post.css
utua.com.br/wp-content/themes/clean-n-beauty-theme/css/ 20 KB
5 KB 58ms
56ms Stylesheet
text/css 2606:4700:10::6816:129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://utua.com.br/wp-content/themes/clean-n-beauty-theme/css/style.post.css?ver=05032024092615
Requested by: Host: utua.com.br
URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c6e298baccf7bccebe558cd80c7473a2c6910bd2b2ec674e63079bc8adfef527

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:15 GMT
via: 1.1 google, 1.1 google
content-encoding: br
cf-cache-status: HIT
age: 71932
cf-polished: origSize=25759
alt-svc: h3=":443"; ma=86400
cf-bgj: minify
last-modified: Mon, 04 Mar 2024 12:01:05 GMT
server: cloudflare
etag: W/"649f-612d47aed4240-gzip"
vary: Accept-Encoding
content-type: text/css
x-cloud-trace-context: fd52d8cf8658fa2c28622193466fc996
cache-control: private, max-age=300
cf-ray: 85fa17e949a39bdc-FRA

GET
H2 200 b0e73efc-ekpara-3-removebg-preview-442x221.png
bucket.utua.com.br/img/2022/09/ 11 KB
11 KB 1456ms
1347ms Image
image/png 2606:4700:10::6816:129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bucket.utua.com.br/img/2022/09/b0e73efc-ekpara-3-removebg-preview-442x221.png
Requested by: Host: utua.com.br
URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00&an_uid=06e138f33e144b4970850ca7d1f4b2aed681ce10aee09663bde40694f92f7ac0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1f198ce53cbb1d2d477576b97789abcfd80a333abd7734fa11402aad037b9a55

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:17 GMT
cf-cache-status: MISS
x-guploader-uploadid: ABPtcPp45ngv3uFVbTc0aZWXO45ODTCh1KHjkgjA88tJXmlhVOiqVy4HslZM9Gqphml2CPipapfF9pKnBA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
content-length: 10911
x-goog-meta-height: 221
x-goog-meta-file-hash: d41d8cd98f00b204e9800998ecf8427e
last-modified: Fri, 16 Sep 2022 20:35:02 GMT
x-goog-meta-child-of: 23952
server: cloudflare
etag: "4106f4c34a7400640ae106f18e636862"
vary: Accept-Encoding
x-goog-generation: 1663360502337662
content-type: image/png
x-goog-hash: crc32c=rKzJwA==, md5=QQb0w0p0AGQK4QbxjmNoYg==
x-goog-meta-width: 442
cache-control: public, max-age=36000, must-revalidate
x-goog-stored-content-length: 10911
accept-ranges: bytes
cf-ray: 85fa17e9e98d3a7f-FRA
x-goog-meta-size: img-442
expires: Tue, 05 Mar 2024 22:26:17 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 321 KB
97 KB 105ms
59ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T48CH8D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1c121a473f2af796f896f549c2be14a9d64969765be3016eb6ed01c4ae1f86ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 99319
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Mar 2024 12:26:16 GMT

GET
H2 200 growthcontrol-lite-ltv.build.js Show response
assets.begrowth.com.br/growthcontrol/ 72 KB
19 KB 180ms
33ms Script
text/javascript 2606:4700:20::681a:551
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.begrowth.com.br/growthcontrol/growthcontrol-lite-ltv.build.js
Requested by: Host: utua.com.br
URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:551 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ccd0757f023e0bbda7f4bbd2c5d84103681c9ce2b771337534d31066853e248d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:16 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2781
cf-polished: origSize=73954
x-guploader-uploadid: ABPtcPrFf0xA-V833i9ni1h24vb4AR3JhXbUseC9K6vDxd-TFBnZDkTgWgf2w2GaSeZ6p2bo67TcY5qzsw
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
cf-bgj: minify
last-modified: Fri, 17 Mar 2023 19:37:01 GMT
server: cloudflare
etag: W/"bdee3d3f971900ba215ddd16446ef924"
vary: Accept-Encoding
x-goog-generation: 1679081821460101
content-type: text/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=ur+DTg==, md5=ve49P5cZALohXd0WRG75JA==
access-control-expose-headers: Content-Type
cache-control: public, max-age=1800
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KWESqcYgqb7qqHkMRXEyBFPdMZ%2FdaeOfqI9ryjEZiyTHcBdC4VD3sfDjQ3Kd%2BSVqk4fBot2uJeEHPuhbPEGrdI7KwS3HPbsXmPyXHY9MX2l%2BQDU8%2FTxSZ5Wp3EH5DAJgPcpVwtI0FCNpFPWfa5%2FJxQI0e2o%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 73954
cf-ray: 85fa17eabaa23a86-FRA
expires: Tue, 05 Mar 2024 11:40:55 GMT

GET
H3 200 spritesheet.png
utua.com.br/wp-content/themes/clean-n-beauty-theme/images/ 1 KB
2 KB 39ms
39ms Image
image/webp 2606:4700:10::6816:129
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://utua.com.br/wp-content/themes/clean-n-beauty-theme/images/spritesheet.png
Requested by: Host: utua.com.br
URL: https://utua.com.br/wp-content/themes/clean-n-beauty-theme/css/style.post.css?ver=05032024092615
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:10::6816:129 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 729fdd056968891a9b7a1eb8fa6365f58a7da10fd953e837feec3bea6501b585

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/wp-content/themes/clean-n-beauty-theme/css/style.post.css?ver=05032024092615
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:15 GMT
via: 1.1 google, 1.1 google
cf-cache-status: HIT
age: 75054
cf-polished: origFmt=png, origSize=3567
content-disposition: inline; filename="spritesheet.webp"
alt-svc: h3=":443"; ma=86400
content-length: 1366
cf-bgj: imgq:85,h2pri
last-modified: Mon, 04 Mar 2024 12:01:05 GMT
server: cloudflare
etag: "def-612d47aed4240"
vary: Accept
content-type: image/webp
x-cloud-trace-context: 1cf0c3e671677e5c94f747073d443f60
cache-control: max-age=300
accept-ranges: bytes
cf-ray: 85fa17e9cafd6933-FRA

GET
H2 200 rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwAopxRSW32.woff2
fonts.gstatic.com/s/dmsans/v14/ 14 KB
14 KB 66ms
18ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/dmsans/v14/rP2tp2ywxg089UriI5-g4vlH9VoD8CmcqZG40F9JadbnoEwAopxRSW32.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b99e2ac0acd1e779f2db8aa9fc92e5901207ad6150689a5318163a70ee667157

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://utua.com.br
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 23:03:17 GMT
x-content-type-options: nosniff
age: 48179
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14132
x-xss-protection: 0
last-modified: Wed, 12 Jul 2023 22:06:27 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Mar 2025 23:03:17 GMT

GET
H2 200 pubads_impl.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/ 428 KB
135 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e518d28fc305914d99970e7793785ff5143eb03b1ff3eaf90f980d3e28758cdd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 10:21:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 7482
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137662
x-xss-protection: 0
server: cafe
etag: 2919427224111863329
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 05 Mar 2025 10:21:34 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 442 KB
97 KB 999ms
998ms Fetch
text/plain 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=956148494517527&correlator=120257166274493&eid=31079956&output=ldjh&gdfp_req=1&vrg=202402220101&ptt=17&impl=fifs&iu_parts=21862753527%2Cutua_desk_top%2Cutua_desk_content%2Cutua_desk_sidebar%2Cutua_desk_interstitial&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=728x250%7C970x250%7C980x90%2C336x280%7C300x250%2C120x600%7C160x600%7C300x600%7C300x250%2C1x1&ifi=1&sfv=1-0-40&ists=1&fas=0%2C0%2C0%2C8&sc=1&cookie_enabled=1&abxe=1&dt=1709641576125&lmt=1709641575&adxs=436%2C632%2C1468%2C-9&adys=98%2C400%2C122%2C-9&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0%7C0%7C0%7C-1&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Futua.com.br%2Fth-emp-scb-speedy-loan-p1%2F%3Futm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00&vis=1&psz=1600x1200%7C800x0%7C120x250%7C0x-1&msz=1600x0%7C800x0%7C120x250%7C0x-1&fws=4%2C4%2C516%2C2&ohw=1600%2C1600%2C1600%2C0&ga_vid=227499955.1709641576&ga_sid=1709641576&ga_hid=658642704&ga_fc=false&dlt=1709641575872&idt=221&cust_params=request_uri%3D%252Fth-emp-scb-speedy-loan-p1%252F%26utm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00%26placement%3Ddirect%26hour%3D13%26dayshifts%3Dmorning&adks=3399986936%2C4290368170%2C695725469%2C687659283&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a30fa92c5f2d9da5efaa8dda5b5fb96c501a5b48ae32bc1d50738d9c0eb1ae23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 99513
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://utua.com.br
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3945 6 KB
3 KB 183ms
89ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://utua.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 12:26:16 GMT
expires: Wed, 05 Mar 2025 12:26:16 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/ 46 KB
15 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8828dd7692bd9f1c8f728dce776e7dbdc1bf6df88f85f3f5f9cda752d79a83cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:11:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 15262
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15011
x-xss-protection: 0
server: cafe
etag: 5257715224640773649
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 05 Mar 2025 08:11:54 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 268 KB
90 KB 48ms
48ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Y1WZWFMSQF&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T48CH8D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

97df0d1a29dd699b934cdd754fa0cfc181943a7de920d43f4fcc34f4a6d01abe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:16 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92484
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Mar 2024 12:26:16 GMT

GET
H2 200 / Show response
location.begrowth.com.br/ 117 B
560 B 253ms
32ms Fetch
application/json 2606:4700:20::681a:451
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://location.begrowth.com.br/
Requested by: Host: assets.begrowth.com.br
URL: https://assets.begrowth.com.br/growthcontrol/growthcontrol-lite-ltv.build.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:451 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c79e05c99a1c085999ea622d27df29c52c50bf64749d7415d78e319e1e6be5b7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:16 GMT
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XrhxdcYwnzTe1yYT1jzSzlC5Izd544Ds%2B%2BRduDyMjkfUCbDn8EC0%2Bkt5k1Ylbfiq4EQQg6uiRlOBfknMqBz%2BiJ%2BjOdpm815zVHosmQK8rs2UyecTYxlWpc8MCUXFjd6ERpxGZFODE%2FFQpPkurMWmXM9AZju2YA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-methods: GET,POST
access-control-allow-origin: *
content-type: application/json
cf-ray: 85fa17ec98a92bd2-FRA

POST
H2 204 collect
region1.analytics.google.com/g/ 0
251 B 71ms
26ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-Y1WZWFMSQF&gtm=45je42t1v880217120z8813036978za220&_p=1709641575958&_gaz=1&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=227499955.1709641576&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1709641576&sct=1&seg=0&dl=https%3A%2F%2Futua.com.br%2Fth-emp-scb-speedy-loan-p1%2F%3Futm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00&dt=%E0%B8%81%E0%B8%B9%E0%B9%89%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B8%98%E0%B8%99%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%84%E0%B8%97%E0%B8%A2%E0%B8%9E%E0%B8%B2%E0%B8%93%E0%B8%B4%E0%B8%8A%E0%B8%A2%E0%B9%8C%20%E0%B8%AD%E0%B8%99%E0%B8%B8%E0%B8%A1%E0%B8%B1%E0%B8%95%E0%B8%B4%E0%B9%80%E0%B8%A3%E0%B9%87%E0%B8%A7&en=page_view&_fv=2&_ss=2&_c=1&tfd=2029
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Y1WZWFMSQF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://utua.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
242 B 77ms
25ms Ping
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-Y1WZWFMSQF&cid=227499955.1709641576&gtm=45je42t1v880217120z8813036978za220&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Y1WZWFMSQF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://utua.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 90ms
45ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-Y1WZWFMSQF&cid=227499955.1709641576&gtm=45je42t1v880217120z8813036978za220&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l2l1&npa=1&z=581295898

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 64ms
27ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-Y1WZWFMSQF&gtm=45je42t1v880217120za220&_p=1709641575958&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=227499955.1709641576&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEA&_s=2&sid=1709641576&sct=1&seg=0&dl=https%3A%2F%2Futua.com.br%2Fth-emp-scb-speedy-loan-p1%2F%3Futm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00&dt=%E0%B8%81%E0%B8%B9%E0%B9%89%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B8%98%E0%B8%99%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%84%E0%B8%97%E0%B8%A2%E0%B8%9E%E0%B8%B2%E0%B8%93%E0%B8%B4%E0%B8%8A%E0%B8%A2%E0%B9%8C%20%E0%B8%AD%E0%B8%99%E0%B8%B8%E0%B8%A1%E0%B8%B1%E0%B8%95%E0%B8%B4%E0%B9%80%E0%B8%A3%E0%B9%87%E0%B8%A7&en=scroll&_c=1&epn.percent_scrolled=90&_et=5&tfd=2037
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Y1WZWFMSQF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:16 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://utua.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 /
growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app/ Frame 0
0 642ms
469ms Preflight
text/html 2001:4860:4802:32::35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://utua.com.br
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 05 Mar 2024 12:26:16 GMT
server: Google Frontend
x-cloud-trace-context: f3282576a60e634fe5d625a919f3a40d

OPTIONS
H2 200 /
growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app/ Frame 0
0 403ms
231ms Preflight
text/html 2001:4860:4802:32::35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://utua.com.br
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-headers: Content-Type
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html
date: Tue, 05 Mar 2024 12:26:16 GMT
server: Google Frontend
x-cloud-trace-context: 89ed580cc4361bd41316570dced3e0f6

POST
H3 200 / Show response
growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app/ 0
13 B 1318ms
1317ms XHR
text/html 2001:4860:4802:32::35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app/
Requested by: Host: assets.begrowth.com.br
URL: https://assets.begrowth.com.br/growthcontrol/growthcontrol-lite-ltv.build.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://utua.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 05 Mar 2024 12:26:18 GMT
server: Google Frontend
content-type: text/html
access-control-allow-origin: *
x-cloud-trace-context: 0c3fc496522b4aec56985e49fea6d6d3
access-control-allow-headers: Content-Type
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

POST
H2 200 / Show response
growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app/ 0
75 B 1055ms
1054ms XHR
text/html 2001:4860:4802:32::35
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app/
Requested by: Host: assets.begrowth.com.br
URL: https://assets.begrowth.com.br/growthcontrol/growthcontrol-lite-ltv.build.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::35 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://utua.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 05 Mar 2024 12:26:17 GMT
server: Google Frontend
content-type: text/html
access-control-allow-origin: *
x-cloud-trace-context: d1f609214a35e586d1670186f6415bdb
access-control-allow-headers: Content-Type
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 container.html Show response
5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 2754 6 KB
3 KB 21ms
20ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://utua.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 12:26:16 GMT
expires: Wed, 05 Mar 2025 12:26:16 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 container.html Show response
5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame BFB6 6 KB
3 KB 21ms
20ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://utua.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 12:26:16 GMT
expires: Wed, 05 Mar 2025 12:26:16 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 amp4ads-v0.mjs Show response
cdn.ampproject.org/rtv/012402262017000/ Frame 0B63 196 KB
55 KB 88ms
27ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ec3f51275e9591ecc8a2cc293de405e036b86192cef5c919c1ae19a9b5fb3c7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Mar 2024 08:53:20 GMT
age: 12777
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56141
x-xss-protection: 0
server: sffe
etag: "28cb2d39d2a36ad8"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 05 Mar 2025 08:53:20 GMT

GET
H2 200 amp-ad-exit-0.1.mjs Show response
cdn.ampproject.org/rtv/012402262017000/v0/ Frame 0B63 15 KB
5 KB 127ms
66ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402262017000/v0/amp-ad-exit-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57c1d1b1b0b9057e20276bead208fa9c95048bfce328b24c73c15d0c0e158e5d

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 04 Mar 2024 18:11:24 GMT
age: 65693
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5220
x-xss-protection: 0
server: sffe
etag: "49cab81f34612748"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Mar 2025 18:11:24 GMT

GET
H2 200 amp-analytics-0.1.mjs Show response
cdn.ampproject.org/rtv/012402262017000/v0/ Frame 0B63 95 KB
28 KB 118ms
58ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402262017000/v0/amp-analytics-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6a6187838cc4af1fd500f6de6c5dc5b10af97a8db371ffd1feca4981e28a149a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Mar 2024 08:56:50 GMT
age: 12567
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29016
x-xss-protection: 0
server: sffe
etag: "d87e4eaec13170fc"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Wed, 05 Mar 2025 08:56:50 GMT

GET
H2 200 amp-carousel-0.1.mjs Show response
cdn.ampproject.org/rtv/012402262017000/v0/ Frame 0B63 33 KB
10 KB 127ms
67ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402262017000/v0/amp-carousel-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9b4c0ab676abf50eaadb6af8f3a8d3a55ac330426538172cddacebb005d249f8

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 04 Mar 2024 18:11:29 GMT
age: 65688
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10086
x-xss-protection: 0
server: sffe
etag: "8579f6af3a52d3eb"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Mar 2025 18:11:29 GMT

GET
H2 200 amp-fit-text-0.1.mjs Show response
cdn.ampproject.org/rtv/012402262017000/v0/ Frame 0B63 5 KB
2 KB 124ms
65ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402262017000/v0/amp-fit-text-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbf6ee11b4dc9fce4e7a0e68c509a883ad3dc18779ed25d8c22eb7f2cec45ea4

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 04 Mar 2024 18:11:24 GMT
age: 65693
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1906
x-xss-protection: 0
server: sffe
etag: "92d49a70059f031a"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Mar 2025 18:11:24 GMT

GET
H2 200 amp-form-0.1.mjs Show response
cdn.ampproject.org/rtv/012402262017000/v0/ Frame 0B63 40 KB
14 KB 79ms
20ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402262017000/v0/amp-form-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2770e2403192a7b11afe55d92fcda866ca008ff7e05e08ea98e8da20ece4b6d7

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 04 Mar 2024 18:11:24 GMT
age: 65693
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12941
x-xss-protection: 0
server: sffe
etag: "abc788b0a91a2b6d"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Mar 2025 18:11:24 GMT

GET
H2 200 amp-gwd-animation-0.1.mjs Show response
cdn.ampproject.org/rtv/012402262017000/v0/ Frame 0B63 6 KB
2 KB 52ms
50ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/012402262017000/v0/amp-gwd-animation-0.1.mjs

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc1cb20b48cc03dec32f9386e1b0e8cdf28cedf0fee7d1148660bdc77286fb4a

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Mon, 04 Mar 2024 18:11:29 GMT
age: 65688
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2436
x-xss-protection: 0
server: sffe
etag: "9e337d6a365866a6"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 04 Mar 2025 18:11:29 GMT

GET
DATA 200
OK truncated
/ Frame 0B63 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ddf2190f60bbc5fe2548a610fbc3237167ae22104a3b8b08b6537bf769bd31b4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 th.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 0B63 3 KB
4 KB 71ms
21ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/th.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cad58f215d074424bf4b9310a814d9ea51931235a3afe31ee2e69c58e8f75bec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:01:53 GMT
x-content-type-options: nosniff
server: cafe
age: 59064
etag: 12800268860518071124
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3306
x-xss-protection: 0
expires: Tue, 05 Mar 2024 20:01:53 GMT

GET
H2 200 icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 0B63 344 B
449 B 71ms
21ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/pagead/images/abg/icon.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 19:01:23 GMT
x-content-type-options: nosniff
server: cafe
age: 62694
etag: 6766994032117382215
vary: Accept-Encoding
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/png
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 344
x-xss-protection: 0
expires: Tue, 05 Mar 2024 19:01:23 GMT

GET
H2 200 img01-04-06.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 76 KB
76 KB 93ms
43ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/img01-04-06.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b628231885a42bc1dd1b9170ff1d7faf1026817f4b3a14b2a4f5f9065e5adb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 03:33:42 GMT
date: Tue, 05 Mar 2024 03:33:42 GMT
x-content-type-options: nosniff
age: 31955
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78050
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 text01.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 2 KB
2 KB 105ms
56ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text01.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2223818ec9d690162947d1a4e743156c2b0166716155bc04df589091c1d00fa8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:52:29 GMT
date: Tue, 05 Mar 2024 08:52:29 GMT
x-content-type-options: nosniff
age: 12828
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2211
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 img02.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 45 KB
45 KB 72ms
23ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/img02.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

635e1370bf54ff06e46587b49e35bf077d8690c8f4fc1dd8c3fae7584f401839

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 09:04:08 GMT
date: Tue, 05 Mar 2024 09:04:08 GMT
x-content-type-options: nosniff
age: 12129
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45660
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 text02.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 4 KB
4 KB 69ms
55ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text02.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2936cf62b1a8f32d71c0ae54cf961f354ede2327f229e886c979277e213ace0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 01:19:46 GMT
date: Tue, 05 Mar 2024 01:19:46 GMT
x-content-type-options: nosniff
age: 39991
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3616
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 img03.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 66 KB
66 KB 54ms
52ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/img03.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d81e581b18c6bed85968ed9f8d61c54969de5c472ddd52d16d9cabeefc23885c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:47:38 GMT
date: Tue, 05 Mar 2024 08:47:38 GMT
x-content-type-options: nosniff
age: 13119
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67094
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 text03.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 7 KB
7 KB 48ms
47ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text03.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

953c365c6751c46998ee21e05d45f78700df08722ad6dd24b2fd3167eec8d78a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Tue, 04 Mar 2025 14:55:48 GMT
date: Mon, 04 Mar 2024 14:55:48 GMT
x-content-type-options: nosniff
age: 77429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6663
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 text04.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 4 KB
4 KB 59ms
58ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text04.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

041cf2df5f93aa94850980322087f5ba6ba65ae19144dd27914e791ee5e079d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:50:34 GMT
date: Tue, 05 Mar 2024 08:50:34 GMT
x-content-type-options: nosniff
age: 12943
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3630
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 text06.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 5 KB
5 KB 59ms
58ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text06.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a965c4604f19039fe4ad3f9ba306aed57a7a31161dedd6761d095ccb605a0c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:47:38 GMT
date: Tue, 05 Mar 2024 08:47:38 GMT
x-content-type-options: nosniff
age: 13119
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4858
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 logo.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 3 KB
3 KB 53ms
52ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/logo.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b9b1b1fb6c228c61ce724c7195cbf7b05886e169c3ea9ce718da37a31847898

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 09:04:08 GMT
date: Tue, 05 Mar 2024 09:04:08 GMT
x-content-type-options: nosniff
age: 12129
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2782
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 Mazda_Garantie.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 3 KB
4 KB 52ms
51ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/Mazda_Garantie.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e715d5150fca48d678ed24da834835e4ebf0f37bb9070be1d5e5305738ff0f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 06:43:46 GMT
date: Tue, 05 Mar 2024 06:43:46 GMT
x-content-type-options: nosniff
age: 20551
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3555
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 cta.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 539 B
633 B 51ms
51ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/cta.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98b861f29fca5d5dd31d4d43e8da45b611607530d0def1ed3a07f12a04a0af12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Tue, 04 Mar 2025 20:40:03 GMT
date: Mon, 04 Mar 2024 20:40:03 GMT
x-content-type-options: nosniff
age: 56774
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 539
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 27ms
26ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-Y1WZWFMSQF&gtm=45je42t1v880217120za220&_p=1709641575958&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=227499955.1709641576&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEI&_s=3&sid=1709641576&sct=1&seg=0&dl=https%3A%2F%2Futua.com.br%2Fth-emp-scb-speedy-loan-p1%2F%3Futm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00&dt=%E0%B8%81%E0%B8%B9%E0%B9%89%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B8%98%E0%B8%99%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%84%E0%B8%97%E0%B8%A2%E0%B8%9E%E0%B8%B2%E0%B8%93%E0%B8%B4%E0%B8%8A%E0%B8%A2%E0%B9%8C%20%E0%B8%AD%E0%B8%99%E0%B8%B8%E0%B8%A1%E0%B8%B1%E0%B8%95%E0%B8%B4%E0%B9%80%E0%B8%A3%E0%B9%87%E0%B8%A7&en=ad_impression&_c=1&ep.query_id=CLWj3paP3YQDFePiuwgdtv4O1g&_et=900&tfd=2941
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Y1WZWFMSQF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://utua.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 26ms
25ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-Y1WZWFMSQF&gtm=45je42t1v880217120za220&_p=1709641575958&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=227499955.1709641576&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEI&_s=4&sid=1709641576&sct=1&seg=0&dl=https%3A%2F%2Futua.com.br%2Fth-emp-scb-speedy-loan-p1%2F%3Futm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00&dt=%E0%B8%81%E0%B8%B9%E0%B9%89%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B8%98%E0%B8%99%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%84%E0%B8%97%E0%B8%A2%E0%B8%9E%E0%B8%B2%E0%B8%93%E0%B8%B4%E0%B8%8A%E0%B8%A2%E0%B9%8C%20%E0%B8%AD%E0%B8%99%E0%B8%B8%E0%B8%A1%E0%B8%B1%E0%B8%95%E0%B8%B4%E0%B9%80%E0%B8%A3%E0%B9%87%E0%B8%A7&en=ad_impression&_c=1&ep.query_id=CLaj3paP3YQDFePiuwgdtv4O1g&_et=1&tfd=2945
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Y1WZWFMSQF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://utua.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 25ms
25ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-Y1WZWFMSQF&gtm=45je42t1v880217120za220&_p=1709641575958&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=227499955.1709641576&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEI&_s=5&sid=1709641576&sct=1&seg=0&dl=https%3A%2F%2Futua.com.br%2Fth-emp-scb-speedy-loan-p1%2F%3Futm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00&dt=%E0%B8%81%E0%B8%B9%E0%B9%89%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B8%98%E0%B8%99%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%84%E0%B8%97%E0%B8%A2%E0%B8%9E%E0%B8%B2%E0%B8%93%E0%B8%B4%E0%B8%8A%E0%B8%A2%E0%B9%8C%20%E0%B8%AD%E0%B8%99%E0%B8%B8%E0%B8%A1%E0%B8%B1%E0%B8%95%E0%B8%B4%E0%B9%80%E0%B8%A3%E0%B9%87%E0%B8%A7&en=ad_impression&_c=1&ep.query_id=CLej3paP3YQDFePiuwgdtv4O1g&_et=1&tfd=2949
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Y1WZWFMSQF&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://utua.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame ADDD 6 KB
3 KB 22ms
21ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://utua.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 12:26:16 GMT
expires: Wed, 05 Mar 2025 12:26:16 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 26ms
26ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-Y1WZWFMSQF&gtm=45je42t1v880217120za220&_p=1709641575958&gcd=13l3l3l2l1&npa=1&dma_cps=sypham&dma=1&cid=227499955.1709641576&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_eu=AEI&_s=6&sid=1709641576&sct=1&seg=0&dl=https%3A%2F%2Futua.com.br%2Fth-emp-scb-speedy-loan-p1%2F%3Futm_source%3Dclevertap%26utm_medium%3Demail%26utm_campaign%3Dth-utua-ct-email-emp%26utm_content%3Dth-utua-ct-email-emp-p2-aqui%26utm_term%3Dth-utua-ct-email-emp-p2-aqui-00&dt=%E0%B8%81%E0%B8%B9%E0%B9%89%E0%B8%87%E0%B9%88%E0%B8%B2%E0%B8%A2%E0%B8%98%E0%B8%99%E0%B8%B2%E0%B8%84%E0%B8%B2%E0%B8%A3%E0%B9%84%E0%B8%97%E0%B8%A2%E0%B8%9E%E0%B8%B2%E0%B8%93%E0%B8%B4%E0%B8%8A%E0%B8%A2%E0%B9%8C%20%E0%B8%AD%E0%B8%99%E0%B8%B8%E0%B8%A1%E0%B8%B1%E0%B8%95%E0%B8%B4%E0%B9%80%E0%B8%A3%E0%B9%87%E0%B8%A7&en=ad_impression&_c=1&ep.query_id=CLij3paP3YQDFePiuwgdtv4O1g&_et=33&tfd=2988
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-Y1WZWFMSQF&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://utua.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1095 624 B
827 B 122ms
59ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIjTkokCMAE&v=APEucNX7W2i22jxFFhbeRIYYLcLwxmCDl_Jw82QyNJUpI8dumEuaG2_IhbG6dKA5JV-SU9RtI-xmfo6Z33d6x5hM5sz7Y-MdKfEoCoCKc40a2CBI6RaEqPJc-XNgzKLnPGSGQ269EsSrDx5z_qrk15vYAhSMOaTvhVKXuK4Bak-zT25BP9_iZqU

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 12:26:17 GMT
expires: Tue, 05 Mar 2024 12:26:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2754 93 KB
33 KB 129ms
69ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33320
x-xss-protection: 0
server: cafe
etag: 12501049806231860069
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Tue, 05 Mar 2024 12:26:17 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2754 42 B
173 B 125ms
66ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AuUvDrwdJF1xD2CQSUygfqiInHCIZpNdjU0VjtqZKJkqfn0gmD5mQ1mwj3oVNiMq3gNPd3AwhlAp-fO20Lj7kmLm8IkayipAJABIoOAWcTurlk648

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 2754
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1878143/78738416/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1015562965&ias_pubId=pub-1757064723917999&ias_chanId=1&ias_place...
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&ias_xappb=

43 B
483 B

73ms
18ms

Image
image/gif

2600:9000:223f:c600:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&ias_xappb=
Requested by: Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:223f:c600:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 11 Dec 2023 17:29:44 GMT
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
via: 1.1 d4744f6f4cb683596fb4a26e59b2aba8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P5
age: 7325794
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: A7saZ5RUYGQVGcT9saKsK0GVJxWRzNrD38StyQGuz_9PaZPS_OeIsQ==

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: nginx
x-server-name: app15.or.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/ Frame 2754 3 KB
1 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/window_focus_fy2021.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:49:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13037
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 08:49:00 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/ Frame 2754 20 KB
8 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:33:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57183
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 20:33:14 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 2754 207 KB
63 KB 76ms
18ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:25:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64050
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 05 Mar 2024 13:25:10 GMT

GET
H2 200 a557c05b701b7d3041e507ef957cdd82.js Show response
www.gstatic.com/mysidia/ Frame BFB6 8 KB
4 KB 73ms
20ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a557c05b701b7d3041e507ef957cdd82.js?tag=client_fast_engine_2019

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

448746297b5f7cd9944269adb069e134c1108f3e2e49f34dd8558de47175f470

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:50:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12974
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3757
x-xss-protection: 0
last-modified: Wed, 28 Feb 2024 00:55:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 03 Jun 2024 08:50:03 GMT

GET
H2 200 d58f9ae6dab7fd31fc6f5125435dd154.js Show response
www.gstatic.com/mysidia/ Frame BFB6 10 KB
4 KB 91ms
38ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d58f9ae6dab7fd31fc6f5125435dd154.js?tag=text/vanilla_highlight_ms

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

09d38b7c7c43a8e44d722091bc07abc9785c30887f55eeae35a6acbc2212d4f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:48:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13059
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4472
x-xss-protection: 0
last-modified: Wed, 28 Feb 2024 00:55:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 03 Jun 2024 08:48:38 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame BFB6 14 KB
1 KB 32ms
32ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Mar 2024 12:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 11:42:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Mar 2024 12:26:17 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/v0/ Frame BFB6 110 KB
32 KB 52ms
50ms Script
text/javascript 2a00:1450:4001:806::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-analytics-0.1.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

934362412466b35500f4daa935aa3353e2bcd2dc62407c8d2d0b820adf5f76ec

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cdnjs.cloudflare.com/ajax/libs/font-awesome/ https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
date: Tue, 05 Mar 2024 12:26:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32179
x-xss-protection: 0
server: sffe
etag: "44a72ccb6e9c4def"
vary: Accept-Encoding
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=604800, stale-while-revalidate=604800
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Tue, 05 Mar 2024 12:26:17 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/ Frame BFB6 2 KB
822 B 21ms
19ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:34:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57117
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 20:34:20 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/ Frame BFB6 23 KB
9 KB 22ms
20ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/abg_lite_fy2021.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:34:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57117
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8947
x-xss-protection: 0
server: cafe
etag: 12299188824252842506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 20:34:20 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/ Frame BFB6 3 KB
1 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/window_focus_fy2021.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:49:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13037
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 08:49:00 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/ Frame BFB6 20 KB
8 KB 44ms
43ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:33:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57183
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 20:33:14 GMT

GET
H2 200 eea50308dcf9de2b0c0fe89d3b5a5e83.js Show response
www.gstatic.com/mysidia/ Frame BFB6 36 KB
15 KB 22ms
20ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/eea50308dcf9de2b0c0fe89d3b5a5e83.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a86d26e0a9759e5d6b482f102d7cade65f3dbe4792972bd59caa9966b9ff568b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 13:40:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81941
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15206
x-xss-protection: 0
last-modified: Wed, 28 Feb 2024 00:55:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 02 Jun 2024 13:40:36 GMT

GET
H2 200 css2
fonts.googleapis.com/ Frame ADDD 5 KB
767 B 29ms
29ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Mar 2024 12:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 11:35:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Mar 2024 12:26:17 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 18D5 2 KB
564 B 27ms
27ms Stylesheet
text/css 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins%3A400%2C600

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6700a61b5bd8006d07ddcdf84df499411e0ca045c8e124af25f72b8c4e82dab3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Mar 2024 12:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Mar 2024 10:48:54 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Mar 2024 12:26:17 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/ Frame 18D5 2 KB
822 B 31ms
21ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:34:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57117
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 20:34:20 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/ Frame 18D5 23 KB
9 KB 30ms
19ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:34:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57117
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8947
x-xss-protection: 0
server: cafe
etag: 12299188824252842506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 20:34:20 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/ Frame 18D5 3 KB
1 KB 31ms
21ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:49:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13037
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 08:49:00 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/ Frame 18D5 20 KB
8 KB 35ms
24ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:33:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 57183
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 20:33:14 GMT

GET
H2 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 18D5 207 KB
63 KB 64ms
48ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:25:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 67
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64050
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 05 Mar 2024 13:25:10 GMT

GET
H2 200 eea50308dcf9de2b0c0fe89d3b5a5e83.js Show response
www.gstatic.com/mysidia/ Frame 18D5 36 KB
15 KB 39ms
21ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/eea50308dcf9de2b0c0fe89d3b5a5e83.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a86d26e0a9759e5d6b482f102d7cade65f3dbe4792972bd59caa9966b9ff568b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 13:40:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81941
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15206
x-xss-protection: 0
last-modified: Wed, 28 Feb 2024 00:55:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 02 Jun 2024 13:40:36 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20240229/r20110914/elements/html/ Frame ADDD 22 KB
9 KB 28ms
21ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20240229/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5efd17aa9600929f5517878dd267b6fdfeca37478d6987b5d75caec4f1e4b1a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 02:53:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34383
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9093
x-xss-protection: 0
server: cafe
etag: 981128176822753981
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 02:53:14 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame ADDD 205 B
519 B 35ms
20ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 18:01:03 GMT
x-content-type-options: nosniff
age: 66314
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 04 Mar 2025 18:01:03 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame ADDD 604 B
695 B 35ms
21ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:03:58 GMT
x-content-type-options: nosniff
age: 58939
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 04 Mar 2025 20:03:58 GMT

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 1095
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKMAAd7uxqgrB3k6CCA7eLs&google_cver=1

43 B
341 B

61ms
57ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKMAAd7uxqgrB3k6CCA7eLs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIjTkokCMAE&v=APEucNX7W2i22jxFFhbeRIYYLcLwxmCDl_Jw82QyNJUpI8dumEuaG2_IhbG6dKA5JV-SU9RtI-xmfo6Z33d6x5hM5sz7Y-MdKfEoCoCKc40a2CBI6RaEqPJc-XNgzKLnPGSGQ269EsSrDx5z_qrk15vYAhSMOaTvhVKXuK4Bak-zT25BP9_iZqU
Protocol: H2
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m1wGKjp6r%2B%2FHi%2BTnJRjafMOXbEq7%2BK2jHo6LEh91nleyRR4bn%2Bo2safb7UXxe8Hjiv%2Bfyu4Zgege7FWpr2dRNQw0CHOhr8UAQUJxOjsKhz9ip001Xyl3HVC%2BAqLPQ5q7rPTrSTB4HIr2bA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 85fa17f45de06a74-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKMAAd7uxqgrB3k6CCA7eLs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 1095
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZecPaVVbLWMAAHUzABh1twAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKMAAd7uxqgrB3k6CCA7eLs&google_cver=1

43 B
768 B

75ms
75ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKMAAd7uxqgrB3k6CCA7eLs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIjTkokCMAE&v=APEucNX7W2i22jxFFhbeRIYYLcLwxmCDl_Jw82QyNJUpI8dumEuaG2_IhbG6dKA5JV-SU9RtI-xmfo6Z33d6x5hM5sz7Y-MdKfEoCoCKc40a2CBI6RaEqPJc-XNgzKLnPGSGQ269EsSrDx5z_qrk15vYAhSMOaTvhVKXuK4Bak-zT25BP9_iZqU
Protocol: H3
Server: 172.64.151.101 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=61ibkBSqm5tqZaiPGYVB0wQj4l9SZnZS1xxGCBGG9deywcEdyBfmtZyb%2BeEmUhD4Skste1ht3%2BZ2DCNok7%2BrFq1IzkDFY%2B3Ue86m6y86iYLQjVta5YogwEVE0vOs1q2Gym9xeaLtInx24w%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 85fa17f52bdd2685-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKMAAd7uxqgrB3k6CCA7eLs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 1095
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECfApMXdjBXyTL-I-0SdQt4&google_cver=1

43 B
1 KB

40ms
38ms

Image
image/gif

185.89.210.82
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECfApMXdjBXyTL-I-0SdQt4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGIjTkokCMAE&v=APEucNX7W2i22jxFFhbeRIYYLcLwxmCDl_Jw82QyNJUpI8dumEuaG2_IhbG6dKA5JV-SU9RtI-xmfo6Z33d6x5hM5sz7Y-MdKfEoCoCKc40a2CBI6RaEqPJc-XNgzKLnPGSGQ269EsSrDx5z_qrk15vYAhSMOaTvhVKXuK4Bak-zT25BP9_iZqU

Protocol

Server

185.89.210.82 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
an-x-request-uuid: 2ab1a797-f479-4a69-81a7-60b397e77838
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 217.114.218.22; 217.114.218.22; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECfApMXdjBXyTL-I-0SdQt4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1095
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU5MjY1MDQ3NTkzNjk0NjIwNA%3D%3D

170 B
243 B

33ms
32ms

Image
image/png

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU5MjY1MDQ3NTkzNjk0NjIwNA%3D%3D

Requested by

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
an-x-request-uuid: b867e928-a664-4758-a713-c7be0b322d5d
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDU5MjY1MDQ3NTkzNjk0NjIwNA%3D%3D
x-proxy-origin: 217.114.218.22; 217.114.218.22; 952.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
DATA 200
OK truncated
/ Frame BFB6 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 746b979a97fed124becba0e389756b4968e02dbe2135f9d343b0418af3420aa5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2754 0
58 B 50ms
50ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5422382986110&version=m202401290101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2754 0
56 B 50ms
49ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5422382986110&version=m202401290101&ct=76&x=1&cor=16179062733391440000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2754 102 KB
40 KB 77ms
76ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DU8m9k3bOzPaspEoBBYqaeU6tM9sPMHHMRRUjZMoFrHzBwBb1QFyMo9B2q5d933YCBer7dIoU3l_Skcu4T1yaZQffqvlMPo0TVkZ7lsfYf7wT2Y6IaDaF94Dem35dDgl7hFPTRHJxhbKk7Iy2MIOikN07abPacIqmSO7rIIjm0VfplYhPIzf2B7LKvo706LLNiOcO8dyxg9eeCIiQPj3EBi30NJA&dbm_d=AKAmf-DIQlNIHYd-84CFgEDJv-rcBPuBqobgu4cvecZnXRI2BrKmstBOPsThUDdaUt-GQa7NbwVnkI-leJWOLORjKKKQAHFJuafB_ldWqkmcqbFPdU5PKVIbzpCBJ4_OAIDw9dccaAmjUvGjRZ65VM7hp0mUNijRP8LJucFFVl19uTB1GsGShoj9VKeQCbM5xE2Wjzpwr__cVcQqM3Lxy1JCDtIQmctdfRwOuXKzbiYRZMmOc2Cb4ZyFmgBH0ucxeGKmfGOSbt0jXihkQ3NnBdA0PjBUUmtZnTJWi-klXFgmg3PU4m8qwU9tWCKCfH6mdGKmebX924m5PKZw0bUoUNlM6EkyqyYzYPhb_uBBjr4bR18TV1ObdufCiTzYOmt94yqiw4efFQVk4JB6UlNA6yvWR_Lnzlix6qRVLHiSiRujCuo0YHflod_353-ZWMzpOSlA5f2TZadTSh__naxdEgqIKZ96grGdCR7ZnS3EtShxfFFJm4cTAqbVhf-VILh86DKoBHxwHJLXC-dGYu3t0AzMp4iaEZCr9lM_2qnIn3klNu4E8Bb6ejc2wlWLjjrTg-UWPiDAFYvXMLdEIxoUJXsoHyq9DEfncAa5e19ddU9pJSacMejo2OuB0HjHBWHgdCgSOCV2F7q6t8XQfa_JIgnP7z8Bcn4k-6kSJrAXC-fecT9bezZfAqFcHIxQVQdFOhB8oXE3OYUrVwU8OTBbDu05JO1r0zreIrEZT6EH4p0wqzwVpf_yY7ZNUDcs1kgJawGwlOVr1cX5HpSDY66zGtPG2-pXfURs9NfU2Y-1t_eNOVZ1omJ49pktCFPSw2R6xZds5ybD27ZEMox4cN3SGzO3ROkjT-xXL99TwbtkrfwdxdQW0MdVnGUAAYvGAjY_iLwZxCpzGD1fRmfbpASlbrMUgD4xow8XKzLni4Mw-nQw-mKkOpqpm935SjTE-744KA91Lrb_pgYgbWlsWCzoULGxG2lRQOpX9cbOre8JLuYVBNyHqiJLFauzE5shU0wLPeMVNuZWxYZA5FlgRjjooUylCSdpwTb5PkdnHBPZGW3UOqkDcHD8ASwueS974fG1xU1UvRrRGG7Myx8v5OYdqv7iqjRILfFGDgoxsEjW4STnAcu3x2MNj0h0ywpKJmyUmHRaSbXMgWQqWPq2gMsEmUj41itueza3LS6yYmELGhh5-EwNOuPiJYpFnyD-LvajMB5zwYCaVvDVuLnqRTgi9HINZ6XRWSwxgoayFOA1Zhha6V_eiJnKtXjlK2ps6LzE1jtnKasYGrNA-JayWnCN5hjxG5jj52AAaC2Zf6im3hKijhZwINueOSYmvM1ZY4cT0SzpYyk0GTxoFy6L99ta4sAmMVZZOVmQNQnXH69X5hqJxspQMxhcxzZkspQC-L6OcWJoMnn13_xOXI0MzXGrgM0PzaSbcXmXKnTP5vpeqLJwhcDS8FxrSnnTZ1bqWNDIdqKkOVqJax6dc4ZsFOw8iqzXk_2DP6jdaUfWenWIyeYlTpS4YZCpmAYPcqFcDoz7E9nn9wV17cJ_imcZnhmotp3y8WXYWiAlUMyijkN7CEjn-4Ut_uoBsZ91Yv6f7xOnWKNBzydNqEIzLSJZ1-JscdJkv_OyH60SAPl0_yvTiNY_WkOascAThTbf5G2ZhcCoEWNqWtCb6m1NTjuxMiV82whm8SMSjx_-f6B98DINQwkAAL2kWp_B0u8iGEJfVQK259jZ7Jak8YWsPabxd0YekVHeAsObawhRxKtyIW8Z1-gPTDXoQEXu2hTqdCdbNDuDVgdKXTN-WcsrgB4ZGg2CchXH2wgWtFqGdK08p7OMAHlg5dHRr8nocTebPqjeXNrpGacZNJAsjKC60YExOozAK9GtsooWohWVtYMB5umbg267buskeBYpiiuYr_lq_2uW0GOZH7YBoyl8GRROXdkfci7L0RS3BxKTp78lZiWqo_x4AGWEH6oZkVV8RAWU8vZ1dxAguxSgvbd9nAfpn8FdC5H4c8UddkY-rqccgJXu3NtokWuXvLwNHf3bynQaDwniTIObpe3NWjFzhgQed-DTpDN4UYHlWgslDILO7UrmCeu-M8cvSRhqdntWku-qk03RMylWcWyxRlcCfXu8LUpWZ6UuwDZ7BqPyu-d24EswvUc1ydaQahBBJYFShr9Mbi8ArXWzxWLXqaC7RJ-8ZfEpcxYkPwswM6DLQOVL4RYzH3y65qK9m1wAPTaCHMtnNZkfuqcLU0a6R35ymPgMhjlxv12aNTPiZkBrqZ7AiK2SSEZ8wI5E3GSsCCi5O6eqWp3Sv_v1kQz8KEiGkIQqy38CSrYkwzohSH6BRjPLEkASm5kEqXNTYnNI2tDsaBj3vt6N5mAjP_OvD_gxTjEKkncDRZrVNQqsO_DQgdCiP7XlHeOfqDHQtrjD7CAOlVsJOVNbEpUxo7xHRDWQtcPoRdmbZ25R-cfafuCWDNaegGoDNNLJGl_WQwiZBXUpBbDjIsVlpUWt7h18lS8b_h4wRsG3GwDKtSkaP7GPAxpS-omYrslecXxUgF45EdzotMKSN-q9yDDtZdYW-IfduMCCabNQRt-N9fnXgq6es-3pCZJ8IMKFTigeKyHqtozuOKJuvXrrZig2Dqcela37UWd0mtwt9yTVZfXjW9hFFDPN4VspbWy8dDcrGO0HawTaxEM0RnfgQybhJBLLn1sPCLDzYGTRkY-yiySR-ii9dCgoimRdj-IElP3rhX3OrlkrgEUGidvX6kHe6C8stBq20aG6I8TSrRnHiq7djflytwlMcOlrOFWRQQMZ-EdNwaXDa3XIgIwMeEwAKLR9w1rbbRitjmJGK0B220kwKIqB30XBKwMWWGN_7WmkJHwdjV3o8Tq-s9bJNnJz5rrfxx_-uhmUgTkdmV2seIVHqVBeddaaj3BMs5FQIletR2DDLDRl-A68gKYUw3UcU30seWgqKKX4jijwhokv0zqBr9BBJ8e-Sx1QfbAiok8pyKsp6tgpeeUG3O4Dnk2AxMkCASSfZUjpB6P9T5kw1D2lx2cA0XCiNTxPNPAexAvzZT9pfpFZRp9nG2_SLnNeovAupH1BPBNjsC5XqYFwxMUwIyWK4mTMFOIvrPUi3WQLtxYMlTovvEIQi5sgBhCsDil2FG3PA1glBJplDyYsjA4f-ie5JeFh8w_-d1Jxq4OYND66L0fnfFFqzayBp51__bSaBB4dnyhqflhXcswRRiYMUHKGbWvyq_z6BhDz6VSlqLOi1QkZ6zGrWsdhGyTLkGza4qjcSmUvGN86DlacOW4xEhvZV7Yycmdbni3RWvnDRP5lUu3uYBrUvXPiQ8mtyKgE5mubQ8tyVuLo59EMVvb1PuiiwkHdqJRD4R8b_cyK99Y-DtJpT_hbYvFefSf5j5u3xS36QtMK547dcP2B8XPK-NPBLsjXykkJOTjXmgBNSQxkrLpPjPCPbj5ZO1nl5k8Ze_uivCQmXj9E4wc_XcvQlHrdE7uoF0ZXfXYzHx14wJkNZZj1_TLqF1kvaNRwk-s-i7Tsmc-QUx-d1OXxY9bBKTeoYchBnJWFnttpDNQwnKSBd5Mqq3kfVc2LWsgKk1kU4xwYVNdicrqRBZpOBcA-9uu1PCR2Ma5h4HQLl2voE0J3IhNIS0n0vJu6s4cPekjuQAk8xYqoj2fcXCtt5zuMlIuHZcjTVpqizg-td2vkfL1IXoo2RJS9OqS6tp4_IPk7x7ClDJiyOIqVpUITK_5Ow6cD-RSHF82t2mCDST2Hnt6rqtKYneXyGPropnjqOdCf-FJAKBf8zVqgVXAfgmPch_aOZI3k6TC7riYrch5JQO07w7eIEBl5Lj6xQVn9iBtvY4FhXGzFWJT7e63bHBkByd5QTdlF14PAMY3z69Fd2k-tDAdTKEt0E99Z8grJO5_g7-9T7OioQ4mOpWeMonwbUeXFuhQPdvWk91wOU0T_raZRwRjcCFFUydbvkGXObbp0ZB9mjZl8WnBnYCV00z-BxWsJ3MdPaxXt5QgIUZ-l1qINK-xjd3Ujd28rL9w6VwUvK3b7khbwYRjtvVg3F4drrWzFDnlfLSt-iEtTZtlD95ODI8zZWP1bc_20hG9SDA8O-X3ZYjdMecQdjPan4GGRWet8EFf1gXP2Khbh6tRFJ3C1GrXiDfA_d1aBk_CWjpzCNoJEHfnm3I6w_ckCs6N54RLAJOBwBCGmnR-e4HjhDEOVdN2NubaQt12vONItjdOcYIk3pGu4LZxw6n7RdXfPmwP6OlNKlYmcHTDg-SCXeLbCpTofZPLmD6uX9gg8pfeYdS0v2IXKIzevHFcEmOft8brJbdNUk9-UxjYrj9kfP9t3HurvHpS9MTOshftEZW-actSB7_Q7JdLLSnYkpCVUPCClJZPQ4ZbJ8S7JcGOYIt2CagWrb336QApUwdvoCI3zLq4Cq_5yU3X1yk80dLzHvhBENA&cid=CAQSTwB7FLtqNbSR_dBT_i2L76yBmnSmUWXU-FaRVQF-gXSYjlaQqgMtuxK0cHWnFyT9IbsJk33qwNgjRPRlp0a6EdyVpj6gtZkjj0UDu3kaY90YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Futua.com.br%2F&ds=l&xdt=1&iif=1&cor=16179062733391440000&adk=356101034&idt=133&cac=0&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f23f077444a04c2ef1128e20036e955a9bc508b351010a3b7fa2776ade2d7144

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40479
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 img01-04-06.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 76 KB
76 KB 21ms
20ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/img01-04-06.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b628231885a42bc1dd1b9170ff1d7faf1026817f4b3a14b2a4f5f9065e5adb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 03:33:42 GMT
date: Tue, 05 Mar 2024 03:33:42 GMT
x-content-type-options: nosniff
age: 31955
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 78050
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text01.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 2 KB
2 KB 30ms
29ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text01.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2223818ec9d690162947d1a4e743156c2b0166716155bc04df589091c1d00fa8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:52:29 GMT
date: Tue, 05 Mar 2024 08:52:29 GMT
x-content-type-options: nosniff
age: 12828
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2211
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 img02.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 45 KB
45 KB 30ms
28ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/img02.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

635e1370bf54ff06e46587b49e35bf077d8690c8f4fc1dd8c3fae7584f401839

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 09:04:08 GMT
date: Tue, 05 Mar 2024 09:04:08 GMT
x-content-type-options: nosniff
age: 12129
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45660
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text02.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 4 KB
4 KB 35ms
34ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text02.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2936cf62b1a8f32d71c0ae54cf961f354ede2327f229e886c979277e213ace0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 01:19:46 GMT
date: Tue, 05 Mar 2024 01:19:46 GMT
x-content-type-options: nosniff
age: 39991
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3616
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 img03.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 66 KB
66 KB 39ms
38ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/img03.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d81e581b18c6bed85968ed9f8d61c54969de5c472ddd52d16d9cabeefc23885c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:47:38 GMT
date: Tue, 05 Mar 2024 08:47:38 GMT
x-content-type-options: nosniff
age: 13119
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67094
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text03.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 7 KB
7 KB 45ms
43ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text03.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

953c365c6751c46998ee21e05d45f78700df08722ad6dd24b2fd3167eec8d78a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Tue, 04 Mar 2025 14:55:48 GMT
date: Mon, 04 Mar 2024 14:55:48 GMT
x-content-type-options: nosniff
age: 77429
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6663
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text04.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 4 KB
4 KB 47ms
46ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text04.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

041cf2df5f93aa94850980322087f5ba6ba65ae19144dd27914e791ee5e079d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:50:34 GMT
date: Tue, 05 Mar 2024 08:50:34 GMT
x-content-type-options: nosniff
age: 12943
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3630
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 text06.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 5 KB
5 KB 37ms
35ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/text06.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a965c4604f19039fe4ad3f9ba306aed57a7a31161dedd6761d095ccb605a0c9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:47:38 GMT
date: Tue, 05 Mar 2024 08:47:38 GMT
x-content-type-options: nosniff
age: 13119
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4858
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 logo.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 3 KB
3 KB 38ms
37ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/logo.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0b9b1b1fb6c228c61ce724c7195cbf7b05886e169c3ea9ce718da37a31847898

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 09:04:08 GMT
date: Tue, 05 Mar 2024 09:04:08 GMT
x-content-type-options: nosniff
age: 12129
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2782
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Mazda_Garantie.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 3 KB
3 KB 35ms
34ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/Mazda_Garantie.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6e715d5150fca48d678ed24da834835e4ebf0f37bb9070be1d5e5305738ff0f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 06:43:46 GMT
date: Tue, 05 Mar 2024 06:43:46 GMT
x-content-type-options: nosniff
age: 20551
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3555
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 cta.png
tpc.googlesyndication.com/sadbundle/12858743862498197945/ Frame 0B63 539 B
567 B 35ms
34ms Image
image/png 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/12858743862498197945/cta.png

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/012402262017000/amp4ads-v0.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

98b861f29fca5d5dd31d4d43e8da45b611607530d0def1ed3a07f12a04a0af12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Tue, 04 Mar 2025 20:40:03 GMT
date: Mon, 04 Mar 2024 20:40:03 GMT
x-content-type-options: nosniff
age: 56774
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 539
x-xss-protection: 0
last-modified: Fri, 16 Feb 2024 10:08:56 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js Show response
pagead2.googlesyndication.com/bg/ Frame 758A 51 KB
20 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de1593e84b846a4788df753166814ba2082f3359e42c4cdb1c3e0b271915212

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 21:52:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52404
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20184
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 21:52:53 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame BFB6 33 KB
33 KB 19ms
19ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 04:01:15 GMT
x-content-type-options: nosniff
age: 30302
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Mar 2025 04:01:15 GMT

OPTIONS
H3 204 adview
securepubads.g.doubleclick.net/pagead/ Frame 0
0 89ms
51ms Preflight
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/adview?ai=C9MuzaA_nZbbPC-PF7_UPtv27sA2zqMyddrfHs_OdEtnZHhABIJ_O9n1glYKAgJgHoAGLvOjsA8gBAakCuyUFCNUzsj7gAgCoAwHIAwqqBIoCT9CzOBZQAD7wZB96c_QQF3xXQpTvemzroc8iPoqxQnhOtUMKFTd9jRiYRiYxKaGYXfwRMCMtuXHhTTyoIkyAfgl--35TyxY1WA-9ebK7U80XExkwRmBrOuwv8ujNubyIP6ndo08NHQC9iOgKHDZpj3jtNq95mp16d_sfYrdobv7QrffIRUtw-8isKQQGh_jyxkyb-UOx2brgVoGwPo0177-xYI1G6vMevbI50P8_wXT6NY8A3ypbxxzl2ToGvZ10YfKPMkGXIUB6r008wMv_9kPgKuuNQVwRgHins9aP6u8GSiWBvSxTlAnOV9kgepLKl_VWz3KnkDmnb_uqymCR7V0jsnOTMpeA5p7ABJL88uDTA-AEAYgF5-Cn2jeSBQQIBBgBkgUECAUYBIAH3cOXE6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4b2AcB8gcGEJj-8YoB0ggrCIDhgBAQARgdMgeqgoDgn4ANOgmAQICAhICAlChIvf3BOliE-NuWj92EA5oJM2h0dHBzOi8vd3d3LmhhbnNlYXRpY2JhbmsuZGUva3JlZGl0a2FydGUvZ2VuaWFsY2FyZIAKA8gLAeINEwjV-9yWj92EAxXj4rsIHbb-DtbYEwyIFAHQFQGAFwGyFx4KHAgAEhRwdWItNDk3OTk3NzQ2MzgzMzAyNBiZgXQ&sigh=cppiGvb088A&uach_m=%5BUACH%5D&ase=2&cid=CAQSTwB7FLtqNbSR_dBT_i2L76yBmnSmUWXU-FaRVQF-gXSYjlaQqgMtuxK0cHWnFyT9IbsJk33qwNgjRPRlp0a6EdyVpj6gtZkjj0UDu3kaY90YAQ&cbvp=2&vis=1&nis=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 05 Mar 2024 12:26:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame BFB6
Redirect Chain

https://securepubads.g.doubleclick.net/pagead/adview?ai=C9MuzaA_nZbbPC-PF7_UPtv27sA2zqMyddrfHs_OdEtnZHhABIJ_O9n1glYKAgJgHoAGLvOjsA8gBAakCuyUFCNUzsj7gAgCoAwHIAwqqBIoCT9CzOBZQAD7wZB96c_QQF3xXQpTvemzr...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227172766446589546145%22,%22debug_reporting%22:true,%22destination%22:%22https://hanseaticbank.de%22,%22event_report_window%...

0
0

99ms
53ms

Fetch
text/css

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227172766446589546145%22,%22debug_reporting%22:true,%22destination%22:%22https://hanseaticbank.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221033510411%22],%2222%22:[%22true%22],%224%22:[%2203-05%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2212281036437342063281%22}&andc=true

Requested by

Protocol

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:18 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"7172766446589546145","debug_reporting":true,"destination":"https://hanseaticbank.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1033510411"],"22":["true"],"4":["03-05"],"6":["true"]},"priority":"500","source_event_id":"12281036437342063281"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: null
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 05 Mar 2024 12:26:18 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 05 Mar 2024 12:26:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"7172766446589546145","debug_reporting":true,"destination":"https://hanseaticbank.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1033510411"],"22":["true"],"4":["03-05"],"6":["true"]},"priority":"500","source_event_id":"12281036437342063281"}&andc=true
access-control-allow-origin: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2754 172 KB
61 KB 78ms
19ms Script
text/javascript 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
Origin: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 18:25:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64818
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Mar 2024 18:25:59 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20240229/r20110914/elements/html/ Frame 2754 12 KB
4 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240229/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DU8m9k3bOzPaspEoBBYqaeU6tM9sPMHHMRRUjZMoFrHzBwBb1QFyMo9B2q5d933YCBer7dIoU3l_Skcu4T1yaZQffqvlMPo0TVkZ7lsfYf7wT2Y6IaDaF94Dem35dDgl7hFPTRHJxhbKk7Iy2MIOikN07abPacIqmSO7rIIjm0VfplYhPIzf2B7LKvo706LLNiOcO8dyxg9eeCIiQPj3EBi30NJA&dbm_d=AKAmf-DIQlNIHYd-84CFgEDJv-rcBPuBqobgu4cvecZnXRI2BrKmstBOPsThUDdaUt-GQa7NbwVnkI-leJWOLORjKKKQAHFJuafB_ldWqkmcqbFPdU5PKVIbzpCBJ4_OAIDw9dccaAmjUvGjRZ65VM7hp0mUNijRP8LJucFFVl19uTB1GsGShoj9VKeQCbM5xE2Wjzpwr__cVcQqM3Lxy1JCDtIQmctdfRwOuXKzbiYRZMmOc2Cb4ZyFmgBH0ucxeGKmfGOSbt0jXihkQ3NnBdA0PjBUUmtZnTJWi-klXFgmg3PU4m8qwU9tWCKCfH6mdGKmebX924m5PKZw0bUoUNlM6EkyqyYzYPhb_uBBjr4bR18TV1ObdufCiTzYOmt94yqiw4efFQVk4JB6UlNA6yvWR_Lnzlix6qRVLHiSiRujCuo0YHflod_353-ZWMzpOSlA5f2TZadTSh__naxdEgqIKZ96grGdCR7ZnS3EtShxfFFJm4cTAqbVhf-VILh86DKoBHxwHJLXC-dGYu3t0AzMp4iaEZCr9lM_2qnIn3klNu4E8Bb6ejc2wlWLjjrTg-UWPiDAFYvXMLdEIxoUJXsoHyq9DEfncAa5e19ddU9pJSacMejo2OuB0HjHBWHgdCgSOCV2F7q6t8XQfa_JIgnP7z8Bcn4k-6kSJrAXC-fecT9bezZfAqFcHIxQVQdFOhB8oXE3OYUrVwU8OTBbDu05JO1r0zreIrEZT6EH4p0wqzwVpf_yY7ZNUDcs1kgJawGwlOVr1cX5HpSDY66zGtPG2-pXfURs9NfU2Y-1t_eNOVZ1omJ49pktCFPSw2R6xZds5ybD27ZEMox4cN3SGzO3ROkjT-xXL99TwbtkrfwdxdQW0MdVnGUAAYvGAjY_iLwZxCpzGD1fRmfbpASlbrMUgD4xow8XKzLni4Mw-nQw-mKkOpqpm935SjTE-744KA91Lrb_pgYgbWlsWCzoULGxG2lRQOpX9cbOre8JLuYVBNyHqiJLFauzE5shU0wLPeMVNuZWxYZA5FlgRjjooUylCSdpwTb5PkdnHBPZGW3UOqkDcHD8ASwueS974fG1xU1UvRrRGG7Myx8v5OYdqv7iqjRILfFGDgoxsEjW4STnAcu3x2MNj0h0ywpKJmyUmHRaSbXMgWQqWPq2gMsEmUj41itueza3LS6yYmELGhh5-EwNOuPiJYpFnyD-LvajMB5zwYCaVvDVuLnqRTgi9HINZ6XRWSwxgoayFOA1Zhha6V_eiJnKtXjlK2ps6LzE1jtnKasYGrNA-JayWnCN5hjxG5jj52AAaC2Zf6im3hKijhZwINueOSYmvM1ZY4cT0SzpYyk0GTxoFy6L99ta4sAmMVZZOVmQNQnXH69X5hqJxspQMxhcxzZkspQC-L6OcWJoMnn13_xOXI0MzXGrgM0PzaSbcXmXKnTP5vpeqLJwhcDS8FxrSnnTZ1bqWNDIdqKkOVqJax6dc4ZsFOw8iqzXk_2DP6jdaUfWenWIyeYlTpS4YZCpmAYPcqFcDoz7E9nn9wV17cJ_imcZnhmotp3y8WXYWiAlUMyijkN7CEjn-4Ut_uoBsZ91Yv6f7xOnWKNBzydNqEIzLSJZ1-JscdJkv_OyH60SAPl0_yvTiNY_WkOascAThTbf5G2ZhcCoEWNqWtCb6m1NTjuxMiV82whm8SMSjx_-f6B98DINQwkAAL2kWp_B0u8iGEJfVQK259jZ7Jak8YWsPabxd0YekVHeAsObawhRxKtyIW8Z1-gPTDXoQEXu2hTqdCdbNDuDVgdKXTN-WcsrgB4ZGg2CchXH2wgWtFqGdK08p7OMAHlg5dHRr8nocTebPqjeXNrpGacZNJAsjKC60YExOozAK9GtsooWohWVtYMB5umbg267buskeBYpiiuYr_lq_2uW0GOZH7YBoyl8GRROXdkfci7L0RS3BxKTp78lZiWqo_x4AGWEH6oZkVV8RAWU8vZ1dxAguxSgvbd9nAfpn8FdC5H4c8UddkY-rqccgJXu3NtokWuXvLwNHf3bynQaDwniTIObpe3NWjFzhgQed-DTpDN4UYHlWgslDILO7UrmCeu-M8cvSRhqdntWku-qk03RMylWcWyxRlcCfXu8LUpWZ6UuwDZ7BqPyu-d24EswvUc1ydaQahBBJYFShr9Mbi8ArXWzxWLXqaC7RJ-8ZfEpcxYkPwswM6DLQOVL4RYzH3y65qK9m1wAPTaCHMtnNZkfuqcLU0a6R35ymPgMhjlxv12aNTPiZkBrqZ7AiK2SSEZ8wI5E3GSsCCi5O6eqWp3Sv_v1kQz8KEiGkIQqy38CSrYkwzohSH6BRjPLEkASm5kEqXNTYnNI2tDsaBj3vt6N5mAjP_OvD_gxTjEKkncDRZrVNQqsO_DQgdCiP7XlHeOfqDHQtrjD7CAOlVsJOVNbEpUxo7xHRDWQtcPoRdmbZ25R-cfafuCWDNaegGoDNNLJGl_WQwiZBXUpBbDjIsVlpUWt7h18lS8b_h4wRsG3GwDKtSkaP7GPAxpS-omYrslecXxUgF45EdzotMKSN-q9yDDtZdYW-IfduMCCabNQRt-N9fnXgq6es-3pCZJ8IMKFTigeKyHqtozuOKJuvXrrZig2Dqcela37UWd0mtwt9yTVZfXjW9hFFDPN4VspbWy8dDcrGO0HawTaxEM0RnfgQybhJBLLn1sPCLDzYGTRkY-yiySR-ii9dCgoimRdj-IElP3rhX3OrlkrgEUGidvX6kHe6C8stBq20aG6I8TSrRnHiq7djflytwlMcOlrOFWRQQMZ-EdNwaXDa3XIgIwMeEwAKLR9w1rbbRitjmJGK0B220kwKIqB30XBKwMWWGN_7WmkJHwdjV3o8Tq-s9bJNnJz5rrfxx_-uhmUgTkdmV2seIVHqVBeddaaj3BMs5FQIletR2DDLDRl-A68gKYUw3UcU30seWgqKKX4jijwhokv0zqBr9BBJ8e-Sx1QfbAiok8pyKsp6tgpeeUG3O4Dnk2AxMkCASSfZUjpB6P9T5kw1D2lx2cA0XCiNTxPNPAexAvzZT9pfpFZRp9nG2_SLnNeovAupH1BPBNjsC5XqYFwxMUwIyWK4mTMFOIvrPUi3WQLtxYMlTovvEIQi5sgBhCsDil2FG3PA1glBJplDyYsjA4f-ie5JeFh8w_-d1Jxq4OYND66L0fnfFFqzayBp51__bSaBB4dnyhqflhXcswRRiYMUHKGbWvyq_z6BhDz6VSlqLOi1QkZ6zGrWsdhGyTLkGza4qjcSmUvGN86DlacOW4xEhvZV7Yycmdbni3RWvnDRP5lUu3uYBrUvXPiQ8mtyKgE5mubQ8tyVuLo59EMVvb1PuiiwkHdqJRD4R8b_cyK99Y-DtJpT_hbYvFefSf5j5u3xS36QtMK547dcP2B8XPK-NPBLsjXykkJOTjXmgBNSQxkrLpPjPCPbj5ZO1nl5k8Ze_uivCQmXj9E4wc_XcvQlHrdE7uoF0ZXfXYzHx14wJkNZZj1_TLqF1kvaNRwk-s-i7Tsmc-QUx-d1OXxY9bBKTeoYchBnJWFnttpDNQwnKSBd5Mqq3kfVc2LWsgKk1kU4xwYVNdicrqRBZpOBcA-9uu1PCR2Ma5h4HQLl2voE0J3IhNIS0n0vJu6s4cPekjuQAk8xYqoj2fcXCtt5zuMlIuHZcjTVpqizg-td2vkfL1IXoo2RJS9OqS6tp4_IPk7x7ClDJiyOIqVpUITK_5Ow6cD-RSHF82t2mCDST2Hnt6rqtKYneXyGPropnjqOdCf-FJAKBf8zVqgVXAfgmPch_aOZI3k6TC7riYrch5JQO07w7eIEBl5Lj6xQVn9iBtvY4FhXGzFWJT7e63bHBkByd5QTdlF14PAMY3z69Fd2k-tDAdTKEt0E99Z8grJO5_g7-9T7OioQ4mOpWeMonwbUeXFuhQPdvWk91wOU0T_raZRwRjcCFFUydbvkGXObbp0ZB9mjZl8WnBnYCV00z-BxWsJ3MdPaxXt5QgIUZ-l1qINK-xjd3Ujd28rL9w6VwUvK3b7khbwYRjtvVg3F4drrWzFDnlfLSt-iEtTZtlD95ODI8zZWP1bc_20hG9SDA8O-X3ZYjdMecQdjPan4GGRWet8EFf1gXP2Khbh6tRFJ3C1GrXiDfA_d1aBk_CWjpzCNoJEHfnm3I6w_ckCs6N54RLAJOBwBCGmnR-e4HjhDEOVdN2NubaQt12vONItjdOcYIk3pGu4LZxw6n7RdXfPmwP6OlNKlYmcHTDg-SCXeLbCpTofZPLmD6uX9gg8pfeYdS0v2IXKIzevHFcEmOft8brJbdNUk9-UxjYrj9kfP9t3HurvHpS9MTOshftEZW-actSB7_Q7JdLLSnYkpCVUPCClJZPQ4ZbJ8S7JcGOYIt2CagWrb336QApUwdvoCI3zLq4Cq_5yU3X1yk80dLzHvhBENA&cid=CAQSTwB7FLtqNbSR_dBT_i2L76yBmnSmUWXU-FaRVQF-gXSYjlaQqgMtuxK0cHWnFyT9IbsJk33qwNgjRPRlp0a6EdyVpj6gtZkjj0UDu3kaY90YAQ&dv3_ver=m202401290101&rfl=https%3A%2F%2Futua.com.br%2F&ds=l&xdt=1&iif=1&cor=16179062733391440000&adk=356101034&idt=133&cac=0&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 21:20:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 54351
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4383
x-xss-protection: 0
server: cafe
etag: 1583492410672046836
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 21:20:26 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20240229/r20110914/ Frame 2754 30 KB
11 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240229/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7d7ccd1b1b1900c730b760fa8b3b5748a073ecdedbd7710e04fbf03cd42afd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:47:00 GMT
content-encoding: br
x-content-type-options: nosniff
age: 56357
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11520
x-xss-protection: 0
server: cafe
etag: 9162932350781899495
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Mon, 18 Mar 2024 20:47:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 2754 41 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 13:46:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81585
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Mar 2025 13:46:32 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 0B63 0
0 67ms
66ms Image
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=C1BJcaA_nZbfPC-PF7_UPtv27sA3L_8CedvSWxLusEprA48LBARABIJ_O9n1glYKAgJgHoAHH8OONA8gBCakCuyUFCNUzsj7gAgCoAwHIAwiqBIoCT9DxGg7N_JfR1UotQvnmq0PBdqXv8b72E7rNC_mi4T8LiPNBRyZE73SnYRJWdbq6VxDO1uboYo1eHLJEgcoOS4q2wDG8b-bHTZKPb0KE4Hy3KdyeGhQYJXI-gDM78YosQymvVoZ1kiJ_lh4_u1KtlhBMZC6lhQ6GuCirRIjkPkqzVKxV_wbA_p-IBXcX3D4PGaHY68i9Ky-q78Az_TyoWj88-i7Nw0BygnhjjBRwkglxoxIZ0TUz78E9ygBjclyk3-xts4dJWKrYKIPLiCM7wtQB2G9c6swC5Pujb_p7BRsoWYlIJiQyVla_JPDZHWaEiNQY6bCC4-fJCWx-JrFzzq6wUw6iPbririPABLjvuobNBOAEAYgFsqvO_U2SBQQIBBgBkgUECAUYBKAGLoAH3IOjcqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4b2AcA8gcFEJOT2gTSCCsIgOGAEBABGB0yB6qCgOCfgA06CYBAgICEgICUKEi9_cE6WIT425aP3YQDmglsaHR0cHM6Ly93d3cubWF6ZGEtYXV0b2hhdXMtZnJpdHNjaC1yaWVkZW5idXJnLmRlL2JlcmF0dW5nLXVuZC1rYXVmL2FuZ2Vib3RlL2FrdHVlbGxlLWFrdGlvbmVuL2xlYXNpbmd3b2NoZW4vgAoDyAsB4g0TCNb73JaP3YQDFePiuwgdtv4O1tgTDdAVAYAXAbIXHgocCAASFHB1Yi00OTc5OTc3NDYzODMzMDI0GJmBdA&sigh=HYsOiKL6mRo&uach_m=%5B%5D&ase=2&nis=5&cid=CAQSTwB7FLtqNbSR_dBT_i2L76yBmnSmUWXU-FaRVQF-gXSYjlaQqgMtuxK0cHWnFyT9IbsJk33qwNgjRPRlp0a6EdyVpj6gtZkjj0UDu3kaY90YAQ&template_id=419&cbvp=2
Requested by: Host: utua.com.br
URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame 2754 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 748798bc54360935f923a93f916f8eff30c94d1714bb7e0fe86fe98d57fe97f5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame DAE4 38 KB
13 KB 28ms
27ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 72602
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 04 Mar 2024 16:16:15 GMT
expires: Tue, 04 Mar 2025 16:16:15 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/13605343744850012072/ Frame C72B 30 KB
5 KB 70ms
29ms Document
text/html 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89d64f8363e9fe274098d3a8744fc70607e0482d5cb955b65a4753d04673bef4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
allow-fenced-frame-automatic-beacons: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 12:26:17 GMT
expires: Wed, 05 Mar 2025 12:26:17 GMT
last-modified: Wed, 27 Sep 2023 08:55:34 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2754 0
0 130ms
65ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssDes11PVJIB_KynqAT6-Do8yB1yJbsm0wAI17JIQ96XVqlPV17CX4Szn5a_spakTcuCa58amUKOGtS4gijkKqZNeZzXDFWIFbNJPPy2RsAPzaDNpi1CwvisYGN4P1jmDse9L0FrLK6pgn-gZuk_JbPt5iBYdqKvpTsHnYnhfG7OvNShdJT2ee62tJqlYG8OHECoxrIegAhKXfr6P3k9UQD3XvmmvOSXyPh8rUlIEEB1WNih8xAtH7Txkysq_x5ACuDuotjk7_EdvuO_UgcGWw7JzvQRAXO38i22IMopNpvgkXexFbY63PH22RxJRUYdsalr-X-ox7PhOBe88GoNNq65cyzEGQB9-rIEFD7cOn-a455v45YYZ47cR7d5-l4eZCgDvDmDcO4e6LZXPCiUu_iMZOyRoqAy2ZeFfIBFLkocdZEe09qFBhavz2Wg1fZamo6Wk3UutTgIXT_AWVegd8s0IxQJX__zwcxZys6msJRtxebQ1wOiv74t1NrFBDL33Sb6Pp6E8q_uN-ul7RcK8lezLvwld278O9TBIpg6-isQ2_dyFhHA3cgsN98kPy21m9W8rS2Q7jZuEvHd2vtEEC0pKLzU_sF6l0N2l2YS5KR0PINtstxhPzNkupUA994qiVJTz1ZH3IpMhLdAz5ZE7dS-56eCW-bpqoirWTwb_6SD33fiE8Y-tvxiOdlL0XpefkAxIYXwByII9BBZXK-pBG-n_223EErpMi9yrG3OQz7SlLNYbVIehdrEqrUU0DwnV3SsJWo77iHGSgz1aJVoxpfUdFJAJAeYbyT8bZHKNa9ZHp08PLhIJ5_r_EwrhFwfJvXuH6KtyubP1ORmIYIQDkYpd3uRrcifxLOjzw2dFQ-XxAWUnDOTHGJvXnt48RZ4aGKjxlSPSYtta7KwtGOld3-7xo94Dw0pBLGV8-aP-YPEZ66rIG9vi8M7z7gqAvYuuEFlQqDu5_YFBEyRVcUOE2zbkY_NvMBtYguuq3Z1Zvr85lFLs4FbwIU_3fkpjqvET97aQfIbwiYsPuOLyzZB5ABgDAkRk7TcVBpvBtLUWk_sxwaClWeYvRGrEJB5Ns457QGgYtWo2LH8lmSp6snA_Xbq17k7jTei1J4yuxwpcr6_39XK9IZP9gaEEEXI3S1w8MN4nPWYYUqrvh1D-g2zLwOmnP7RNwiDk9IjImeKbrpLXStCK_fRMFET_Oxz-ZInmoYvhwfhpJ7LBcFOk0rQkTnikq1dZFGYUbAtVu_KP_FDWh8OGH_uIgTfsEeyxws_P6JUlHACrka4NY1dNoBXBjen-AvBvtkhoKcEaUeVBD1mFS-ZacXZf9ZRxw19vI4kYbDVtw52RDnLoatMSY6wVgt2WcAcs1XKWvI1cPuTZDvuUSOikdXcgWggBF5C2oo8xsjJy2yrwNulO7K&sai=AMfl-YTCO1NVRQ0NrEQVS0AkW7aq0Wnpj4hTH82iQ1kE7v38t7ywoDkN5BI4jNIT-81rdzsubblkLiwJ8uDeiCmZzpQ-KxHQk3xeG_I9ojwumk4ZaH3-dU_UxRm86hfyBQB9__qjVUPFr0dLL5HgdRClCreNe0mOZzZXi3fhFCjU1jc5mnpYVAeaAUi_uRPBjdVLPaq5jrISByC2Vqp-KSbxzjUv2tLcAYhRpdlKiheRG1P06weTPwoxtQyA_YIUB37fhFANWu66WaiJ21F8oXsYNqymAzvwBGLjzz7WHeRfkddjVXFf_IzUlBIZoEF84Ew4ro0&sig=Cg0ArKJSzLctLEjf6LvMEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=147&cbvp=1&cstd=135&cisv=r20240229.60566&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Tue, 05 Mar 2024 12:26:17 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Tue, 05 Mar 2024 12:26:17 GMT

GET
H2

200

firstevent
skydeutschland.demdex.net/ Frame 2754
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184943439&d_placement=389373594&d_campaign=31624803&d_bust=3524584831&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184943439&d_placement=389373594&d_campaign=31624803&d_bust=3524584831&gdpr=&gdp...

42 B
733 B

80ms
79ms

Image
image/gif

52.19.228.126
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184943439&d_placement=389373594&d_campaign=31624803&d_bust=3524584831&gdpr=&gdpr_consent=

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

52.19.228.126 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-19-228-126.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v057-013b23b86.edge-irl1.demdex.com 31 ms
pragma: no-cache
date: Tue, 05 Mar 2024 12:26:18 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: t4zODkz2SNU=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-2-v057-0b917fc02.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Tue, 05 Mar 2024 12:26:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: VwkOuRCcTWQ=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=184943439&d_placement=389373594&d_campaign=31624803&d_bust=3524584831&gdpr=&gdpr_consent=
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 2754 60 B
60 B 142ms
29ms Image
image/gif 213.202.235.8
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=1015562965&extPm=556050824&extCr=20884485503&gdpr=&gdpr_consent=&rnd=3524584831

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.8 , Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Tue, 05 Mar 2024 12:26:17 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Di, 05 Mrz 2024 12:26:17 GMT
X-ET-Code: 0
Content-Type: image/gif
Cache-Control: max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
X-ET-Camp: 923
Expires: Mon, 26 Jul 1997 05:00:00 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 108ms
52ms Preflight
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: null
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Tue, 05 Mar 2024 12:26:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js Show response
pagead2.googlesyndication.com/bg/ Frame DAE4 51 KB
20 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de1593e84b846a4788df753166814ba2082f3359e42c4cdb1c3e0b271915212

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 21:52:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 52404
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20184
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 21:52:53 GMT

GET
H3 200 style.css
s0.2mdn.net/sadbundle/13605343744850012072/ Frame C72B 5 KB
2 KB 22ms
21ms Stylesheet
text/css 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/13605343744850012072/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46072ff450e58861395db6f972ea897ef9e4869c2779aed03527b5b0f994bbb5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Tue, 04 Mar 2025 14:26:17 GMT
date: Mon, 04 Mar 2024 14:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79200
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1757
x-xss-protection: 0
last-modified: Wed, 27 Sep 2023 08:55:34 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame C72B 120 KB
41 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 18:14:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 65498
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Mar 2024 18:14:39 GMT

GET
H3 200 gsap_3.11.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame C72B 69 KB
27 KB 71ms
71ms Script
text/javascript 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.11.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fbae080321632ad4ce06e9207ef9a534abd1d6488a96a0a4334fa768d1f93717

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27635
x-xss-protection: 0
last-modified: Fri, 12 May 2023 16:03:23 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Mar 2024 12:26:17 GMT

GET
H3 200 CTA_FX.png
s0.2mdn.net/creatives/assets/4736540/ Frame C72B 519 B
545 B 20ms
19ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/creatives/assets/4736540/CTA_FX.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13605343744850012072/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e8e59c22f784ae124e2e4ea700d0361f147c5e67417abb1f845f49082190111

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:15:38 GMT
x-content-type-options: nosniff
age: 640
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 519
x-xss-protection: 0
last-modified: Wed, 21 Dec 2022 12:50:41 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Mar 2024 12:30:38 GMT

GET
H3 200 sky_bold.woff
s0.2mdn.net/creatives/assets/3668815/ Frame C72B 28 KB
28 KB 22ms
22ms Font
font/woff 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_bold.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13605343744850012072/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcda08a8d45d378df4fdeafd2529f3c7521d3e9c3a4b12daf2fe2c919940e57b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:21:33 GMT
x-content-type-options: nosniff
age: 285
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28672
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:17 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Mar 2024 12:36:33 GMT

GET
H3 200 sky_regular.woff
s0.2mdn.net/creatives/assets/3668815/ Frame C72B 33 KB
33 KB 23ms
22ms Font
font/woff 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_regular.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13605343744850012072/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f738547bbcdbef189de47347ad84fc0bb0c15164980f51a0214706fa5c94a73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:22:12 GMT
x-content-type-options: nosniff
age: 246
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33980
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:24 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Mar 2024 12:37:12 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2754 0
0 56ms
55ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssDes11PVJIB_KynqAT6-Do8yB1yJbsm0wAI17JIQ96XVqlPV17CX4Szn5a_spakTcuCa58amUKOGtS4gijkKqZNeZzXDFWIFbNJPPy2RsAPzaDNpi1CwvisYGN4P1jmDse9L0FrLK6pgn-gZuk_JbPt5iBYdqKvpTsHnYnhfG7OvNShdJT2ee62tJqlYG8OHECoxrIegAhKXfr6P3k9UQD3XvmmvOSXyPh8rUlIEEB1WNih8xAtH7Txkysq_x5ACuDuotjk7_EdvuO_UgcGWw7JzvQRAXO38i22IMopNpvgkXexFbY63PH22RxJRUYdsalr-X-ox7PhOBe88GoNNq65cyzEGQB9-rIEFD7cOn-a455v45YYZ47cR7d5-l4eZCgDvDmDcO4e6LZXPCiUu_iMZOyRoqAy2ZeFfIBFLkocdZEe09qFBhavz2Wg1fZamo6Wk3UutTgIXT_AWVegd8s0IxQJX__zwcxZys6msJRtxebQ1wOiv74t1NrFBDL33Sb6Pp6E8q_uN-ul7RcK8lezLvwld278O9TBIpg6-isQ2_dyFhHA3cgsN98kPy21m9W8rS2Q7jZuEvHd2vtEEC0pKLzU_sF6l0N2l2YS5KR0PINtstxhPzNkupUA994qiVJTz1ZH3IpMhLdAz5ZE7dS-56eCW-bpqoirWTwb_6SD33fiE8Y-tvxiOdlL0XpefkAxIYXwByII9BBZXK-pBG-n_223EErpMi9yrG3OQz7SlLNYbVIehdrEqrUU0DwnV3SsJWo77iHGSgz1aJVoxpfUdFJAJAeYbyT8bZHKNa9ZHp08PLhIJ5_r_EwrhFwfJvXuH6KtyubP1ORmIYIQDkYpd3uRrcifxLOjzw2dFQ-XxAWUnDOTHGJvXnt48RZ4aGKjxlSPSYtta7KwtGOld3-7xo94Dw0pBLGV8-aP-YPEZ66rIG9vi8M7z7gqAvYuuEFlQqDu5_YFBEyRVcUOE2zbkY_NvMBtYguuq3Z1Zvr85lFLs4FbwIU_3fkpjqvET97aQfIbwiYsPuOLyzZB5ABgDAkRk7TcVBpvBtLUWk_sxwaClWeYvRGrEJB5Ns457QGgYtWo2LH8lmSp6snA_Xbq17k7jTei1J4yuxwpcr6_39XK9IZP9gaEEEXI3S1w8MN4nPWYYUqrvh1D-g2zLwOmnP7RNwiDk9IjImeKbrpLXStCK_fRMFET_Oxz-ZInmoYvhwfhpJ7LBcFOk0rQkTnikq1dZFGYUbAtVu_KP_FDWh8OGH_uIgTfsEeyxws_P6JUlHACrka4NY1dNoBXBjen-AvBvtkhoKcEaUeVBD1mFS-ZacXZf9ZRxw19vI4kYbDVtw52RDnLoatMSY6wVgt2WcAcs1XKWvI1cPuTZDvuUSOikdXcgWggBF5C2oo8xsjJy2yrwNulO7K&sai=AMfl-YTCO1NVRQ0NrEQVS0AkW7aq0Wnpj4hTH82iQ1kE7v38t7ywoDkN5BI4jNIT-81rdzsubblkLiwJ8uDeiCmZzpQ-KxHQk3xeG_I9ojwumk4ZaH3-dU_UxRm86hfyBQB9__qjVUPFr0dLL5HgdRClCreNe0mOZzZXi3fhFCjU1jc5mnpYVAeaAUi_uRPBjdVLPaq5jrISByC2Vqp-KSbxzjUv2tLcAYhRpdlKiheRG1P06weTPwoxtQyA_YIUB37fhFANWu66WaiJ21F8oXsYNqymAzvwBGLjzz7WHeRfkddjVXFf_IzUlBIZoEF84Ew4ro0&sig=Cg0ArKJSzLctLEjf6LvMEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=367&vt=11&dtpt=220&dett=3&cstd=135&cisv=r20240229.60566&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:18 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Tue, 05 Mar 2024 12:26:18 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame C72B 8 KB
6 KB 105ms
58ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b650dc90afb4c1bb229cfdf661b15e95f6bd99d1571693b9aa935921ce94bfba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5963
x-xss-protection: 0

GET
H3 200 DCO_Residential_Super_Mario_Bros_970x250.jpg_1695816401953_DCO_Residential_Super_Mario_Bros_970x250.jpg
s0.2mdn.net/dynamic/2/11041269/s0.2mdn.net/creatives/assets/4736540/ Frame C72B 169 KB
169 KB 25ms
24ms Image
image/jpeg 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11041269/s0.2mdn.net/creatives/assets/4736540/DCO_Residential_Super_Mario_Bros_970x250.jpg_1695816401953_DCO_Residential_Super_Mario_Bros_970x250.jpg

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

15938491f1fd5bce5be56ee941bf2ddd4e9d7806a08a0b151eeee27ac2b518ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:05:06 GMT
x-content-type-options: nosniff
age: 15672
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 173455
x-xss-protection: 0
last-modified: Wed, 27 Sep 2023 12:07:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Mar 2025 08:05:06 GMT

GET
H3 200 blank.png_1672924800548_blank.png
s0.2mdn.net/dynamic/2/11041269/s0.2mdn.net/creatives/assets/4736540/ Frame C72B 95 B
120 B 30ms
29ms Image
image/png 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/11041269/s0.2mdn.net/creatives/assets/4736540/blank.png_1672924800548_blank.png

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9df9512d0f2332b34e43e220b6bdc675dc6b663e72406edde64fd96dc9128e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/index.html?e=69&leftOffset=0&topOffset=0&c=4l8mivtVBb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:04:18 GMT
x-content-type-options: nosniff
age: 15720
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
x-xss-protection: 0
last-modified: Thu, 05 Jan 2023 13:20:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Mar 2025 08:04:18 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DAE4 0
20 B 54ms
53ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BHhwWaQ_nZbaeIKuzx_APkLuuSAAAAAA4AeAEAg&bg=!sbKlsv3NAAaCCwxOogs7ADQBe5WfOJfLVgGko3c_PnAw_oYtffPPdW6jDeOtJ-0CUUkxSyRary9Mqud1BT5zSIAn5RwRAgAAAJ1SAAAABWgBB5kDGeCIZT0j75C2hcctaF7PVWi2KNKpyXe3-BMWSS2ySG3BCyc_ouZrCKvYzp4zalApKYtGPYV1S9c1REY_OD-dMko6aE8H0BuYnhWI9GC9WKjwaDgmxBMAumkEyKef_zATlugxjIm4j5WstHPSki1wkWt0HmQDHW3be3hm5uKkuscUW6TSuJ2BZ5IOQPI_boHK62DAMef3rDFziFJwM92_2plfNKNx92rOZo9PY8OTDvJfSP_tPKI4Lunke1E8CP-a4KbFdCSkigMEGvAmMNtMwOE_AlWfyfzVtrmlNXhromLZA2g2M8mEKvXW_cklxQ42FiGPcGwtinMO3KJKTUmnx8ridumq8mxMYlOH6kXwD4tGsF5B_YsMM8GwHzrCh0Q47TZuea9g_JlCatmIGpXuGrm1tMm18KjnnrNAJdNkhjnago6SZO5bLJOR9Vvta4PVQ03cN6iXt0XQ9RfKmfSr3vgPziF0x72EQKV27Y09QigH9T0mY_S9ydnAUeQzX6D2rdE6BeepFvU71NlgwutPKAo4mLV29bIr2rSbtGWjWfbe6JBJbGJPVLaZScYcsSWOkxHnGipqPK5pGzz9wG_G32vgd0UYU8VZN_iil_Z7yUMIC0mu4QXV16v4DGxgFFC3plzH4bYnQJk0Acehf4S1mDnj-DmwkGfCsWCgJkBiOgDoBYKYv8_Qef3R3Eqc_ToHWlG7r46UOEie8zOjFq5NVdNEAteaLy-vJS4YymwCZ7o7N3dDn0zBd8JWeIzjo_cCG2g8vMwsgW999pxp_8VCNtrBfjTCV9L0TEXUZgKBDdbPs5HsnUBsnRk792uNM0IxZzH7vVN-XNdN_SuFsykcFxmwep4D0iM0qmU41G3JaC3Sxi3nFpGZiL9RClT58ItYOFAbqS4YWTuX7d-nmae0gKSt_LITQBmrh908GIbmherCZwvDHbLQhS4fc2gbWw8YtN9PXVXJVNFxEbYRPcnRHhwqCmceNlKOlc30PGF2COYt5oF_TIBsgN2NvE5HEjFCoxJwG1LRd9f7Y7OrDBh1173kXP4l-NNWPpQ

Requested by

Host: 5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
URL: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sky_medium.woff
s0.2mdn.net/creatives/assets/3668815/ Frame C72B 27 KB
27 KB 23ms
23ms Font
font/woff 2a00:1450:4001:81c::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/13605343744850012072/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4373878b9f750698b6a199ebc0eb0e550df208c5a1f9f778a346e271a2b4d733

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/13605343744850012072/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:20:25 GMT
x-content-type-options: nosniff
age: 353
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27952
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 05 Mar 2024 12:35:25 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 93ms
62ms XHR
application/json 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202402220101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

88d8d192a4ac9b00ee37da549b2159b634baa496fa9dd45565cc7791a56e622e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12481
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame C72B 17 KB
6 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 12:26:18 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 61ms
61ms Script
text/javascript 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202402220101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 12:26:18 GMT

GET
H3 200 hhT7r2j7IM84IjrHPq4DliozylkjplqSUN38T7c3Pqk.js Show response
pagead2.googlesyndication.com/bg/ Frame E1C8 40 KB
15 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hhT7r2j7IM84IjrHPq4DliozylkjplqSUN38T7c3Pqk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8614fbaf68fb20cf38223ac73eae03962a33ca5923a65a9250ddfc4fb7373ea9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 23:25:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46868
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15753
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 23:25:10 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame DA42 13 KB
5 KB 23ms
22ms Document
text/html 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://utua.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 18054
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 07:25:24 GMT
expires: Wed, 05 Mar 2025 07:25:24 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9B68 829 B
1 KB 81ms
31ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d11017b9a478ff7fdb2dbe0cd46bd52561333af9ff78d21f8c0859b1a165d6c5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GovtZnpyoEtMH3cN3Gc1cg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://utua.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-GovtZnpyoEtMH3cN3Gc1cg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 12:26:18 GMT
expires: Tue, 05 Mar 2024 12:26:18 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 hhT7r2j7IM84IjrHPq4DliozylkjplqSUN38T7c3Pqk.js Show response
pagead2.googlesyndication.com/bg/ Frame DA42 40 KB
15 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hhT7r2j7IM84IjrHPq4DliozylkjplqSUN38T7c3Pqk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8614fbaf68fb20cf38223ac73eae03962a33ca5923a65a9250ddfc4fb7373ea9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 23:25:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46868
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15753
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 23:25:10 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9B68 0
0 50ms
49ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202402220101&jk=956148494517527&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame DA42 0
12 B 20ms
19ms Image
text/plain 2a00:1450:4001:80b::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?d-6RQA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 12:26:18 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 0B63 42 B
64 B 53ms
53ms Image
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvMmshqf6_r9tvsOZ9b6NMzI85855wv6p23MxPc6FqhJ_OQAdPnclaKkZFa_QHubNsY0dpcfpKq2EZAtqxYi9JnMrxyFN6YphjlQcwNjnXgaB3-l5HsjqQdyWcfQBFReiaOyYdL3K09PIHBzuXrnv6wJfNWfldDbp4HQcU13kHb&sai=AMfl-YR4SU3xclQOcbpojSBkOpXKFb7CMWW92B7P-OrkiDuDUvy7k0QVQDk40ZGj61dH0ldxfFGvLGuHf2ZQ3G4u1dO_0NQUEQu5tTUkB5zRtPSZp_NzlEGjdvxZkAOTxpAYpc9usH_i9wnVB-R-vlXrdg&sig=Cg0ArKJSzPjzW1XN6nwtEAE&cid=CAQSTwB7FLtqNbSR_dBT_i2L76yBmnSmUWXU-FaRVQF-gXSYjlaQqgMtuxK0cHWnFyT9IbsJk33qwNgjRPRlp0a6EdyVpj6gtZkjj0UDu3kaY90YAQ&id=ampim&o=1288,420&d=300,600&ss=1600,1200&bs=1600,1200&mcvt=1000&mtos=0,0,1000,1000,1000&tos=0,0,1000,0,0&tfs=487&tls=1487&g=100&h=100&tt=1487&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2754 42 B
64 B 56ms
55ms Fetch
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsucfkVKCgZnl29qYGDwmYJ_rZWw3drmSsq7t9hjSiD995OsYW9uL-QcJXLAWpq-2ThGqRf1sTjOjEy0YJkReo1FLh9rZ5EoiqpcJguzwdKFbjzEz1j63G2XKQJoMT-Q8xjhPIQddFN29rM1LOPofBKrDg-mH02wyDurcBbNsxsp&sai=AMfl-YS6HPYzMR0MnxcmywWl3n3ojSyfDzX1xv2fw6RwQHuDfTgSn3IJgcjWwOy0dpL7TWqJVlItlqayEeg5UOHdXoZBwcWaM13yRjtL5QvYXHgja_iQa_2yUwwGnZuVEKsbr9Q2mgr4Tmp0_IpEfV8PQw&sig=Cg0ArKJSzLfRxRtfY2d1EAE&cid=CAQSTwB7FLtqNbSR_dBT_i2L76yBmnSmUWXU-FaRVQF-gXSYjlaQqgMtuxK0cHWnFyT9IbsJk33qwNgjRPRlp0a6EdyVpj6gtZkjj0UDu3kaY90YAQ&id=lidar2&mcvt=1000&p=122,315,372,1285&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240229&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3399986936&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=557437700&rst=1709641577147&rpt=584&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:18 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 53ms
53ms Image
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202402220101&jk=956148494517527&bg=!sbKlsv3NAAauXHXJjlw7ADQBe5WfOOQAVXou3TzKh1XfcPHkz12LIDLZW3yd39tpdfqqdFNIWq7u2hObx26Zsg1Y4ZTVAgAAAFdSAAAABGgBBwoAAtITmQLMm7nNAGqXVIgygG28YqT4npxbOpNTmVVM-HE-PMopgV33934PCnuKq34S_PYBm2_QT0PN4jKgcnRYsoKZEUKlxcR2-rn-fidTRI_Q1IBvHe0zixH1o77V8exV1a_KrP5pegGwtrveucX8yJG1s1tz6FDWjCEp-h1fTBeJc6MnsaSwYsxazGpp4Z5aHeKxzNX2nx-Dfx9hT-DFEjNQLfHI6S26OBKm7l6a6PXLiqJ1x9bNRbUuK87kuk3sFwu5mcQ4hfRfzl92MuT7rugzybDdYBkfAAqyWnNT8MixOfRAl-nhwgIF3UXZ1ynm-i4thZSAJ-6bwkDYtKIZ9h9gfpjkv6pIkIHCuC-DJtIfHkNTtI56GCzzxMtBnmxu2-Nwgwlrq9uhvxwj-m6EQ96l8xhtmWveLCpuV_nUvashK-8qDJfH7kW5c87IWxNdUA4RCInsBR3MqCg0-TQMyet1M9wo73h9V_97gYBeQsEv4RWECnxVT3NP-esRWqMNiIMKyHGB_C1ac4o9inO-NmGKe5NVUO_R7ZoG1SiWKtgBL8-NglqqaZ-FEi8Y260ACj83fGKNGzaNtB2hQa-OTDRpCecQ7yfeNoJXBpR8XdSh4d8Tr-29jEhXzHojEND5Xjo7y4A3VQH51rY37S52JXV1fDhEB7WAP2TNSkQSmlm_fi-MtbnzFFHkfPkJJO8vhBR2kjqEnpnhExULfy1E7oB_v1lAMgzb_9yQCxDrxu0QsCsgW0bvCQGbpTMx3TV_RZACPBjX5-AKALt6uzSPLAH3rMKZWnLg5SxcDTEihTgAttZatr0PuFkQZayah0xeXd2rvefM4DS2L1tIiQZwYPHl1W1_ugdqudFvzx4DFA6PmvZhzc2NnQ1HK7qT02pdtSuks8HRV3Uj_owrd0TwrhATOWPdFEr2WTyjfafSIbX5OoxZmVTOedpoh_CTmbDb5X0
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://utua.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2754 0
20 B 51ms
50ms Ping
image/gif 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5422382986110&version=m202401290101&ct=76&x=1&cor=16179062733391440000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Mar 2024 12:26:19 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

83 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
utua.com.br/th-emp-scb-speedy-loan-p1	1970-01-20 18:55:27	Name: bg_location Value: %7B%22location%22%3A%7B%22country%22%3A%22DE%22%2C%22continent%22%3A%22EU%22%2C%22timezone%22%3A%22Europe%2FBerlin%22%2C%22latitude%22%3A%2251.29930%22%2C%22longitude%22%3A%229.49100%22%7D%7D
.utua.com.br/	1970-01-20 21:03:37	Name: _gcl_au Value: 1.1.461930551.1709641576
.utua.com.br/	1970-01-21 02:06:01	Name: bg_anonymousId Value: 93643262-bf1f-41fd-a204-5e4ce75ad909
.utua.com.br/	1970-01-21 04:30:01	Name: _ga Value: GA1.1.227499955.1709641576
.utua.com.br/	1970-01-20 18:54:03	Name: bg_sessionId Value: 4dca9ffe-229e-440c-a532-6b64694d0f71
.utua.com.br/	1970-01-21 04:15:37	Name: __gads Value: ID=8fed9ba54e4d0a10:T=1709641576:RT=1709641576:S=ALNI_Mas4QjmwwBesbS7y05QrBuWQL2csA
.utua.com.br/	1970-01-21 04:15:37	Name: __gpi Value: UID=00000d698d7e4a51:T=1709641576:RT=1709641576:S=ALNI_MYvCatKgiB6LKZL9RPWDO53qU-p-w
.utua.com.br/	1970-01-20 23:13:13	Name: __eoi Value: ID=c6b9066a20f785bc:T=1709641576:RT=1709641576:S=AA-AfjZ_tnDrFLE0_KeBMuy2Xcam
.utua.com.br/	1970-01-21 04:30:01	Name: _ga_Y1WZWFMSQF Value: GS1.1.1709641576.1.0.1709641577.59.0.0
.doubleclick.net/	1970-01-21 04:15:37	Name: IDE Value: AHWqTUlZsnMmV4yvFLlkpFbmhv8nNyVTdabu7AgGBUvhbFWLnGIZmIftC82sQ9MX
.doubleclick.net/	1970-01-20 23:13:13	Name: APC Value: AfxxVi55aKsHLMt2iYEONoCxPgq02_dxwpOEAYWnSf-Rbv6i0B2yrA
.doubleclick.net/	1970-01-20 23:13:13	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 21:03:37	Name: XANDR_PANID Value: lHohib6nFOEI_4a916MOJuiSyTIQwDkYblpn_895bhNjasW-ismW65bRjUVvNdSM7-RV6TKaBoLchYZisyAL3NPgdmiBPyqFmUPMFnfz7xA.
.adnxs.com/	1970-01-21 04:30:01	Name: receive-cookie-deprecation Value: 1
.adnxs.com/	1970-01-20 21:03:37	Name: uuid2 Value: 4592650475936946204
.casalemedia.com/	1970-01-21 03:39:37	Name: CMID Value: ZecPaVVbLWMAAHUzABh1twAA
.casalemedia.com/	1970-01-20 21:03:37	Name: CMPS Value: 5185
.casalemedia.com/	1970-01-20 21:03:37	Name: CMPRO Value: 5185
.adnxs.com/	1970-01-20 21:03:37	Name: anj Value: dTM7k!M41.D>6NRF']wIg2E>9rzHe[!]tbPl1M>e)ZlrFUfJ+tGXxoaVYcsj9v[gH9yQ4<^/EIlI*]QuQ<:?`J7V_m3If)y3KL9D3I?+OWjfLm
m.exactag.com/	1970-01-20 21:03:37	Name: exactag_new_gk Value: 2acb2a9c913d49e6960441f92bec3706%7C04.05.2024%2012%3A26%3A17
m.exactag.com/	1970-01-20 23:13:13	Name: exactag_new_uk Value: 18f8740a5afe4a95bcfd8a2f903d1f01%7C
m.exactag.com/	1969-12-31 23:59:59	Name: session_session Value: ad4c587dec0549469c3e5c1a
.demdex.net/	1970-01-20 23:13:13	Name: demdex Value: 11339662686267181760128540724730275890
.googleadservices.com/	1970-01-20 21:03:37	Name: ar_debug Value: 1
.skydeutschland.demdex.net/	1970-01-20 23:13:13	Name: skydeutschland Value: 11339662686267181760128540724730275890

45 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://utua.com.br/th-emp-scb-speedy-loan-p1/?utm_source=clevertap&utm_medium=email&utm_campaign=th-utua-ct-email-emp&utm_content=th-utua-ct-email-emp-p2-aqui&utm_term=th-utua-ct-email-emp-p2-aqui-00 Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5260e8162af9ed8f8e25582284816684.safeframe.googlesyndication.com
assets.begrowth.com.br
bucket.utua.com.br
cdn.ampproject.org
cm.g.doubleclick.net
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
growthcontrol-events-endpoint-go-wfqcv7fa5a-rj.a.run.app
ib.adnxs.com
location.begrowth.com.br
m.exactag.com
pagead2.googlesyndication.com
pixel.adsafeprotected.com
region1.analytics.google.com
s0.2mdn.net
securepubads.g.doubleclick.net
skydeutschland.demdex.net
static.adsafeprotected.com
stats.g.doubleclick.net
tpc.googlesyndication.com
u28949501.ct.sendgrid.net
utua.com.br
wizrocketmail.net
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
142.250.181.226
142.250.185.130
142.250.186.162
143.204.98.106
167.89.123.147
172.64.151.101
185.89.210.82
2001:4860:4802:32::35
2001:4860:4802:34::36
213.202.235.8
2600:9000:223f:c600:8:48e:53c0:93a1
2606:4700:10::6816:129
2606:4700:20::681a:451
2606:4700:20::681a:551
2a00:1450:4001:806::2001
2a00:1450:4001:808::200a
2a00:1450:4001:80b::2001
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2002
2a00:1450:4001:812::2008
2a00:1450:4001:81c::2001
2a00:1450:4001:81c::2006
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2004
2a00:1450:4001:82f::2003
2a00:1450:4001:830::2002
2a00:1450:400c:c00::9d
35.166.159.2
52.19.228.126
041cf2df5f93aa94850980322087f5ba6ba65ae19144dd27914e791ee5e079d1
09d38b7c7c43a8e44d722091bc07abc9785c30887f55eeae35a6acbc2212d4f9
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0b9b1b1fb6c228c61ce724c7195cbf7b05886e169c3ea9ce718da37a31847898
0e8e59c22f784ae124e2e4ea700d0361f147c5e67417abb1f845f49082190111
15938491f1fd5bce5be56ee941bf2ddd4e9d7806a08a0b151eeee27ac2b518ce
1a965c4604f19039fe4ad3f9ba306aed57a7a31161dedd6761d095ccb605a0c9
1c121a473f2af796f896f549c2be14a9d64969765be3016eb6ed01c4ae1f86ca
1ec3f51275e9591ecc8a2cc293de405e036b86192cef5c919c1ae19a9b5fb3c7
1f198ce53cbb1d2d477576b97789abcfd80a333abd7734fa11402aad037b9a55
2223818ec9d690162947d1a4e743156c2b0166716155bc04df589091c1d00fa8
2770e2403192a7b11afe55d92fcda866ca008ff7e05e08ea98e8da20ece4b6d7
2936cf62b1a8f32d71c0ae54cf961f354ede2327f229e886c979277e213ace0c
2f738547bbcdbef189de47347ad84fc0bb0c15164980f51a0214706fa5c94a73
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2
435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f
4373878b9f750698b6a199ebc0eb0e550df208c5a1f9f778a346e271a2b4d733
448746297b5f7cd9944269adb069e134c1108f3e2e49f34dd8558de47175f470
46072ff450e58861395db6f972ea897ef9e4869c2779aed03527b5b0f994bbb5
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6
53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
57c1d1b1b0b9057e20276bead208fa9c95048bfce328b24c73c15d0c0e158e5d
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5efd17aa9600929f5517878dd267b6fdfeca37478d6987b5d75caec4f1e4b1a8
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
635e1370bf54ff06e46587b49e35bf077d8690c8f4fc1dd8c3fae7584f401839
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
6700a61b5bd8006d07ddcdf84df499411e0ca045c8e124af25f72b8c4e82dab3
6a6187838cc4af1fd500f6de6c5dc5b10af97a8db371ffd1feca4981e28a149a
6b628231885a42bc1dd1b9170ff1d7faf1026817f4b3a14b2a4f5f9065e5adb3
6e715d5150fca48d678ed24da834835e4ebf0f37bb9070be1d5e5305738ff0f8
729fdd056968891a9b7a1eb8fa6365f58a7da10fd953e837feec3bea6501b585
746b979a97fed124becba0e389756b4968e02dbe2135f9d343b0418af3420aa5
748798bc54360935f923a93f916f8eff30c94d1714bb7e0fe86fe98d57fe97f5
8614fbaf68fb20cf38223ac73eae03962a33ca5923a65a9250ddfc4fb7373ea9
8828dd7692bd9f1c8f728dce776e7dbdc1bf6df88f85f3f5f9cda752d79a83cd
88d8d192a4ac9b00ee37da549b2159b634baa496fa9dd45565cc7791a56e622e
89d64f8363e9fe274098d3a8744fc70607e0482d5cb955b65a4753d04673bef4
8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460
9159ff44d7094b8c99c902b187018a7e1115252e3c0438f9d4622295cd00d287
934362412466b35500f4daa935aa3353e2bcd2dc62407c8d2d0b820adf5f76ec
953c365c6751c46998ee21e05d45f78700df08722ad6dd24b2fd3167eec8d78a
97df0d1a29dd699b934cdd754fa0cfc181943a7de920d43f4fcc34f4a6d01abe
98b861f29fca5d5dd31d4d43e8da45b611607530d0def1ed3a07f12a04a0af12
9b4c0ab676abf50eaadb6af8f3a8d3a55ac330426538172cddacebb005d249f8
9de1593e84b846a4788df753166814ba2082f3359e42c4cdb1c3e0b271915212
9df9512d0f2332b34e43e220b6bdc675dc6b663e72406edde64fd96dc9128e1b
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a30fa92c5f2d9da5efaa8dda5b5fb96c501a5b48ae32bc1d50738d9c0eb1ae23
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
a6ee58f60c407b083623fdc4586ae66d10f4586920a825a74e26762bc262eefd
a7d7ccd1b1b1900c730b760fa8b3b5748a073ecdedbd7710e04fbf03cd42afd8
a86d26e0a9759e5d6b482f102d7cade65f3dbe4792972bd59caa9966b9ff568b
a9e33327dc1c082d5807d6a3db066134be1653f9336e867cc6d681ec51d0c335
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac
b5d113f0bbd1580311da5a7e50e8991dcdfb434f983b02d4309cd732a7b8c589
b650dc90afb4c1bb229cfdf661b15e95f6bd99d1571693b9aa935921ce94bfba
b99e2ac0acd1e779f2db8aa9fc92e5901207ad6150689a5318163a70ee667157
c6e298baccf7bccebe558cd80c7473a2c6910bd2b2ec674e63079bc8adfef527
c79e05c99a1c085999ea622d27df29c52c50bf64749d7415d78e319e1e6be5b7
c7dae6228d5c6b272885ca8b925bfa63c90df71ed4c7fc94e036bd37e8e453a1
cad58f215d074424bf4b9310a814d9ea51931235a3afe31ee2e69c58e8f75bec
cbf6ee11b4dc9fce4e7a0e68c509a883ad3dc18779ed25d8c22eb7f2cec45ea4
cc1cb20b48cc03dec32f9386e1b0e8cdf28cedf0fee7d1148660bdc77286fb4a
ccd0757f023e0bbda7f4bbd2c5d84103681c9ce2b771337534d31066853e248d
d11017b9a478ff7fdb2dbe0cd46bd52561333af9ff78d21f8c0859b1a165d6c5
d81e581b18c6bed85968ed9f8d61c54969de5c472ddd52d16d9cabeefc23885c
dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48
dcda08a8d45d378df4fdeafd2529f3c7521d3e9c3a4b12daf2fe2c919940e57b
ddf2190f60bbc5fe2548a610fbc3237167ae22104a3b8b08b6537bf769bd31b4
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e518d28fc305914d99970e7793785ff5143eb03b1ff3eaf90f980d3e28758cdd
eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987
ed0e7e64215a9663152e2d5c1c9a5ba0fe76c9f5de3dfe71bf45f0a64e977c69
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f23f077444a04c2ef1128e20036e955a9bc508b351010a3b7fa2776ade2d7144
fbae080321632ad4ce06e9207ef9a534abd1d6488a96a0a4334fa768d1f93717

utua.com.br Open in urlscan Pro 2606:4700:10::6816:129 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

137 Requests

95 %HTTPS

67 %IPv6

20 Domains

31 Subdomains

28 IPs

4 Countries

2008 kBTransfer

4674 kBSize

25 Cookies

0 Outgoing links

Page URL History

Redirected requests

137 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

utua.com.br Open in urlscan Pro
2606:4700:10::6816:129 Public Scan

Screenshot
Live screenshot

Full Image

137
Requests

95 %
HTTPS

67 %
IPv6

20
Domains

31
Subdomains

28
IPs

4
Countries

2008 kB
Transfer

4674 kB
Size

25
Cookies

137 HTTP transactions
3 data transactions